QNAP removes backdoor account in NAS backup, disaster recovery app

Posted by & filed under Security Alerts.

QNAP has addressed a critical vulnerability allowing attackers to log into QNAP NAS (network-attached storage) devices using hardcoded credentials.

The hard-coded credentials vulnerability tracked as CVE-2021-28799 was found by Taiwan-based ZUSO ART in HBS 3 Hybrid Backup Sync, the company’s disaster recovery and data backup solution.

The company says that the security bug is already fixed in the following HBS versions and advises customers to update the software to the latest released version:

  • QTS 4.5.2: HBS 3 Hybrid Backup Sync 16.0.0415 and later
  • QTS 4.3.6: HBS 3 Hybrid Backup Sync 3.0.210412 and later
  • QuTS hero h4.5.1: HBS 3 Hybrid Backup Sync 16.0.0419 and later
  • QuTScloud c4.5.1~c4.5.4: HBS 3 Hybrid Backup Sync 16.0.0419 and later

To update HBS on your NAS device, you have to log into QTS or QuTS hero as administrator. Next, search for “HBS 3 Hybrid Backup Sync” in App Center, and then click Update and OK to update the application (the Update option is not available if HBS is already up to date.)

While QNAP published the security announcing that CVE-2021-28799 was fixed today, the app’s release notes for version 16.0.0415 lists it as fixed almost a week ago, on April 16th.

A QNAP spokesperson said that the disclosure delay was caused by the additional time needed to release patches for QuTS hero and QuTScloud HBS versions (the security update for QTS was released six days ago).

QNAP also added that its PSIRT team has not found evidence of active exploitation of this vulnerability in the wild.

On the same day, QNAP fixed two other HBS command injection vulnerabilities, as well as two more critical vulnerabilities, a command injection bug in QTS and QuTS hero (CVE-2020-2509) and an SQL Injection vulnerability in Multimedia Console and the Media Streaming Add-On (CVE-2020-36195), that could allow attackers to gain full access to NAS devices.

Ongoing Qlocker ransomware campaign targeting QNAP users

Critical security bugs such as these allow threat actors to take over NAS devices and, in some cases, deploy ransomware to encrypt the users’ files and ask hefty ransoms for a decryptor.

Threat actors are also known to take over NAS devices and use them to “proxy their connection to interact with the webshells they placed on these devices” and hide their malicious activity within regular remote work traffic, according to CISA.

QNAP said that they believe a new ransomware strain known as Qlocker exploits the SQL Injection vulnerability (CVE-2020-36195) to encrypt data on vulnerable devices.

This is precisely what has been happening since at least April 19th, when attackers behind a massive campaign deploying a new ransomware strain known as Qlocker started moving QNAP customers’ files in password-protected 7zip archives and asking for ransoms.

 

QNAP devices targeted by ransomware before

Qlocker is not the first ransomware to target QNAP devices, given that they are commonly used to store sensitive personal files and are the perfect leverage to force victims into paying a ransom to decrypt their data.

In June 2020, QNAP warned of eCh0raix ransomware attacks targeting Photo Station app security flaws.

eCh0raix (aka QNAPCrypt) returned one year later, trying to gain access to QNAP devices by exploiting known vulnerabilities and brute-forcing accounts with weak passwords.

QNAP also alerted customers in September 2020 of an AgeLocker ransomware campaign targeting publicly exposed NAS devices by exploiting older and vulnerable Photo Station versions.

QNAP customers are advised to go through the following procedure to secure their NAS devices and check for malware:

  • Change all passwords for all accounts on the device
  • Remove unknown user accounts from the device
  • Make sure the device firmware is up-to-date, and all of the applications are also updated
  • Remove unknown or unused applications from the device
  • Install QNAP MalwareRemover application via the App Center functionality
  • Set an access control list for the device (Control panel -> Security -> Security level)

 

The information contained in this website is for general information purposes only. The information is gathered from BLEEPING COMPUTER, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.