Synology Urges DSM Updates After Ransomware Attacks on NAS Devices

Synology is urging customers to update DiskStation Manager (DSM) software on its Network Attached Storage (NAS) devices after ransomware attacks. The Taiwanese vendor said threat actors exploited a vulnerability patched in December 2024 to target devices running outdated DSM versions. These attacks aim to encrypt data and extort ransom, the company said in a statement released last week.

Vulnerabilities in November 2024 Advisory

While Synology did not disclose the exact security flaw being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities. CVE-2024-10441, with a CVSS score of 9.8, is an improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors. CVE-2024-50629, with a CVSS score of 5.3, is an improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limited files via unspecified vectors. CVE-2024-10445, with a CVSS score of 4.3, is an improper certificate validation vulnerability in the update functionality in DSM that could allow remote attackers to write limited files via unspecified vectors.

Patched Versions and Recommended Actions

The issues were addressed in several DSM versions. DSM 7.2.2 users should upgrade to 7.2.2-72806-1 or above. DSM 7.2.1 users should upgrade to 7.2.1-69057-6 or above. DSM 7.2 users should upgrade to 7.2-64570-4 or above. DSM 7.1 users should upgrade to 7.1.1-42962-7 or above. DSM 6.2 users should upgrade to 6.2.4-25556-8 or above. Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.

Reported C3RB3R Ransomware Activity

The development comes amid reports from customers that their Synology devices have been hit by C3RB3R ransomware, which has been observed locking users' files with a '.L0CK3D' extension.

Past NAS Ransomware Incidents

This is not the first time NAS devices have been the target of ransomware attacks. In 2019, NAS devices manufactured by Taiwan-based QNAP Systems were compromised by QNAPCrypt, also known as eCh0raix, ransomware. In August 2021, Synology warned of brute-force attacks driven by a malware family called StealthWorker that led to ransomware infections. 'These attacks leverage a number of already infected devices to try and guess common administrative credentials, and if successful, will access the system to install its malicious payload, which may include ransomware,' it said at the time. 'Devices infected may carry out additional attacks on other Linux-based devices, including Synology NAS.' That same month, Palo Alto Networks Unit 42 also disclosed details of an eCh0raix variant targeting NAS devices from both QNAP and Synology by leveraging vulnerabilities like CVE-2021-28799 or brute-forcing their way in by making use of commonly used administrative credentials.

Sources: The Hacker News