QNAP ships NAS backup software with hidden credentials

https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450#p788325

by criddell • 5 years ago

190 157 5 years ago

forum.qnap.com

criddell4• 5 years ago

QNAP shipped Hybrid Backup Sync with hardcoded credentials of walter:walter. This was used by ransomware criminals to encrypt photos and videos and demand payment in Bitcoin for the password to decrypt the data.

From that page:

The code has 27 occurrences of e-mails: waltershao@gmail.com or walterentry20140225@gmail.com in the code.

More information is available here:

https://www.helpnetsecurity.com/2021/04/26/qnap-nas-ransomwa...

judge2020• 5 years ago

Was there any development on if there was an actual investigation or help from Google to identify the fraudsters, given these are @gmail email addresses?

hedora3• 5 years ago

Walter Shao is a qnap employee, and probably not related to the fraudsters.

rkagerer• 5 years ago

The latest HBS 3 Hybrid Backup Sync 16.0.0419 has 1215 lines of code with the word "walter".

Walter's a popular guy. (Apparently he's QNAP's Technical Manager)

bastard_op• 5 years ago

No wonder he was promoted, so he'd stop doing stupid things like that. Obviously they've not wiped up enough after him.

jchw• 5 years ago

QNAP has some enticing out of the box NAS products, but I guess I feel a bit better having chosen Synology.

That’s not to say I necessarily love any of these vendors too much. They feel a bit too much like feature mills that have lower incentive to adopt better security practices and higher incentives to add features and, well, provide a decent user experience. I appreciate the latter, but it isn’t ideal.

Still, as much as I’d love a NAS running open source software and maybe even open hardware, I think the amount of time and effort spent on doing so would not be well rewarded. So for now, I guess I’ll ride the useful life of my Synology NAS out and go from there.

As for this incident, it is embarrassing, but it happens. Hopefully this will motivate more people to do security research on these devices.

zf00002• 5 years ago

I am still happily running FreeNAS 11. I haven't updated to 12 and it's name change to TrueNAS. Anyway, the amount of janitoring I have to do with it is very minimal. Over the last year, less than 1 hour of time spent total.

coffee_is_nom• 5 years ago

Another very happy freenas user, been running freenas (now truenas) for 8 years. Other than hard drive upgrade and one hard drive failure it has been pretty smooth. My overhead in last year has been maybe 5 hours of upkeep.

buro9• 5 years ago

Synology on the other hand just remove file systems that you may be using https://news.ycombinator.com/item?id=26800062

LeoPanthera2• 5 years ago

Your one-line summary of the situation is wildly misleading. You had to migrate disks from devices that support btrfs to devices which were advertised as not supporting it, but it just happened to work.

berkut• 5 years ago

Now that ReadyNAS (Netgear bought them years ago, but the hardware and software was still decent up until recently when they stopped releasing updates) seems to have given up in the (pro)consumer space (4+ drives), is Synology the only option now?

Asustor and WD seem to be making more advanced and larger drives, maybe they're options...

karmicthreat5• 5 years ago

Synology has always had better software. But they have been more expensive and they have been threatening to lock out some features unless you use their drives.

There is no real competitor on the market right now except QNAP. And who wants to deal with FreeNAS, I have better and more important things to do with my time at work.

cosmotic2• 5 years ago

How is Synology software better?

I've had the pleasure of setting up rsync between Synology and QNAP and I would say the Synology software appears to be better but actually isn't as good.

Synology appears to use older versions of a lot of tools like rsync. Although it doesn't say so, it doesn't rsync the data files, it rsync's the files that make up the backing of the software-raid. It's like rsync of the blocks of a sparse disk image instead of the files within the disk image. This makes it impossible to resume or adopt a previous backup. If any of the configuration for the rsync-send changes, it appears to download the entire remote so that it can compare the contents of the files to the local instead of hashing remotely, which nearly completely defeats the point of using rsync. It took my backup task WEEKS to adopt an existing backup that had very few changes.

sodality2• 5 years ago

Thank you Walter Shao, best engineer ever! This is really good for your CV! Oh, and you owe a few people 0.01 BTC...

Best line of the thread

bigmattystyles• 5 years ago

I feel bad for Walter and people blaming him as the sole responsible party are just part of a mob reaction - is this backdoor bad; yes, QNAP should suffer a financial setback*, but who among us hasn't done something like which then combined with pressure to release from management and (obviously) poor corporate code review and audit practices gone on to 'almost'** release something that shouldn't be.

My point, this isn't on Walter alone, in fact, most of it isn't, it's the software development processes (or lack thereof) that allowed this happen. My guess, Walter will be shown the door, QNAP will be able to say we took action and got rid of Walter but the true issue, the bad process that led to this, is probably still there. Worst, Walter's knowledge of the code base will also be gone.

And no, I'm not Walter if anyone is wondering.

* they won't

**'almost' is in quotes for plausible deniability reasons on my end..

rsj_hn• 5 years ago

Agreed, the new password should be feelbadforwalter --> decrypt + base64 zbQOp+Pa0RxqLuTjuNnJ3A==

bbernhard90• 5 years ago

Am I the only one that thinks that connecting the NAS directly to the internet is a stupid idea to begin with?

Don't get me wrong, I can totally understand why people (without much technical background) are tempted to do this. But with all the complexity these NAS systems nowadays have it was only a matter of time for something like this to happen.

ziml77• 5 years ago

I think it's insane to do. I wouldn't want to open my NAS up to the internet. I can VPN into my home network if I need to access it remotely.

abfan1127• 5 years ago

I can't imagine attaching anything directly to the internet outside my router.

criddell4• 5 years ago

And you likely have UPnP disabled.

criddell4• 5 years ago

I think it's a bad idea as well but I don't blame people for doing so because of how QNAP markets them.

Competing products are marketed in the same way.

karmicthreat5• 5 years ago

Other than your router you should not have ANYTHING directly on the internet these days.

There is just too much surface area for device software now and cost pressure doesn't allow for security to be much of a priority.

comboy• 5 years ago

I'd like to hear what HN folks would most comfortably put as that router (device/software).

ClumsyPilot• 5 years ago

No reason to believe a random offf the shelf router is any more secure than any other device

mbreese2• 5 years ago

With the QNAP cloud service, even if the server was behind a firewall/NAT, you could still directly access the NAS from the internet. So, you could still get caught with this.

Source: I have a QNAP NAS and after the first week, I couldn’t figure out who was trying to login to it as an admin account. Thankfully, I had changed all the passwords, but by default it had connected to their cloud service and was remotely accessible. I’m still not 100% sure I have it completely secured.

dvdkon• 5 years ago

So are you completely against self-hosting services or do you apply this only to closed (IoT) appliances?

aborsy2• 5 years ago

The device can be hacked even within LAN. These gadgets sometimes use UPnP and open ports on routers. A lot of ISP provided routers support UPnP.

rce• 5 years ago

If you use Google or Apple photos you are connecting to their computers that are exposed directly to the internet, but I would much rather own my data rather than have these corporations own it. The question in my mind is why these NAS companies are so comparatively terrible at writing secure software.

fulafel• 5 years ago

Assuming you aren't talking about completely air gapped parallel IT infra: The alternative comes with different administration burdens after which you've built an insecure internal network that is still indirectly internet connected and can be breached. If it's not that in the beginning, it will become one, due to human factors.

Hamuko3• 5 years ago

Nope. My Synology is only reachable via a VPN. Even connecting to the Plex server on it requires a VPN.

ksec4• 5 years ago

Yes, I made the suggestions to both QNAP and Synology for having an simple single option to disable ALL Cloud function and Internet connection. I want an Intranet NAS. Not an Internet NAS.

But they seems to think they dont add value without the Internet stuff.

I dont use any of the Internet stuff. I only want my files to be shared within the network in my home. And doing it myself require so much tinkering.

rhexs2• 5 years ago

I really wish there was a small NAS case that didn't look like a massive box. The QNAP/Synology 4 bay low power form factor is just killer for fitting into small spaces, but if I could put a core i5 in one of those with some flash to get some more VMs going and run linux or some BSD distro, that'd be incredible.

Smallest one I've found is https://www.u-nas.com/xcart/cart.php?target=product&product_..., but not quite as compact as I'd hope.

As I can't find DIY hardware like that, Synology looks to have a slightly more mature vulnerability response program than QNAP -- apparently they have a bounty? I've heard about less Synology flaws, so hopefully they're a slightly better choice on the software side.

aDfbrtVt• 5 years ago

I use one of these chassis [1], the form factor is great. Be mindful that some of the bracing blocks the pcie slot on some motherboards.

[1] https://m.aliexpress.com/item/33038670915.html?spm=a2g0n.pro...

tremon5• 5 years ago

I have this one at home: https://www.mini-itx.com/~NAS6 . It measures roughly 20x20x30 cm and can fit a standard mini-itx motherboard. Not as small as a dedicated ARM box, but the smallest I could find. Fitting the PSU is very fiddly though, there is hardly any space between the PSU and the HDD backplane.

paol2• 5 years ago

Would you mind giving a quick review of the acoustic characteristics of the case?

I'm looking to move away from a QNAP box, and one of the driving reasons is the horrible "hard-plastic hard-mount everything" design that couldn't amplify hard drive noise any more if they'd done it on purpose.

eightails• 5 years ago

A lot of people seem to use refurbished enterprise sff machines (optiplex micro, thinkcentre m, etc) for vms and similar, if your storage needs are more modest. I've also seen some run WD externals from them via the stock usb enclosures, although I'm not sure if running raid or the like on usb devices is a good idea.

jaidan• 5 years ago

The HP Gen10Plus Microserver might do what you're after [0].

I've been running the Gen 7 since January 2013 with Ubuntu 16.04 then 20.04. It's travelled between New Zealand, Australia and South Korea multiple times. The Russian BIOS enabled hotplug and took the speed restriction off the CD-ROM SATA port.

I run a Sandisk SSD (purchased 2014) in the Cd rom bay and 3x 8GB WD Red (CMR) drives. The fourth bay I use for transferring or backing up other drives. I used Mdadm for software RAID as the "hardware RAID" needed special drivers and it was too hard at the time.

I haven't played with the Gen10Plus yet but it'll probably be the direction I head instead of a NAS. They come with Xeon processors and 4 ethernet ports!

[0] https://buy.hpe.com/au/en/servers/proliant-microserver/proli...

rhexs2• 5 years ago

Wow, almost a perfect solution. Unfortunately, it doesn't support quicksync if you swap to a CPU that supports it. :(

vangelis• 5 years ago

U-Nas (https://www.u-nas.com/) makes compact NAS cases with bays. They sometimes have servers in stock too.

trengrj• 5 years ago

If you want a small NAS in a similar form factor I'd recommend Helios64 5-bay NAS https://kobol.io/. It is an Arm64 board runs mainline Armbian. Also comes with 2.5Gbit networking and a built in UPS battery.

I don't understand why people who care about security and have linux knowledge would use Synology/QNAP. They are both proprietary, often exposed to the internet, and packed full of so many features that they are consistently full of vulnerabilities (SynoLocker/QLocker etc).

thinkmassive• 5 years ago

Helios64 looks amazing but they've been sold out for a while.

You had my hopes up for a moment there, haha

patentatt• 5 years ago

Seems to be so common with these niche SBCs and accessories. They look so cool, but are unobtainable. People sometimes complain about the over-use of RasPis, but one thing they have going for them is that you can always find them available from many different sources.

ed25519FUUU• 5 years ago

The built-in UPS feature is very cool.

icedchai2• 5 years ago

It's very cool, until something goes wrong with it. IMHO you are better off getting an external UPS and putting some other stuff on it.

tremon5• 5 years ago

Well, I did buy a QNAP TS-419P many years ago. It's still running mainline Debian, that was why I bought it. I would have replaced it with a newer model if the new ones were similarly open, but they're not.

Seriously considering a Helios64, once they get their supply issues resolved.

3v1n0• 5 years ago

I also got it one but it's just something I use to run a container to manage my nextcloud and other stuff...

azdle4• 5 years ago

I _desperately_ want something like this, but in a 1U 4-drive form factor. If someone is working on something like this, _please_ let me know. It doesn't even have to be an RK3399 based system, just something that works with a mainline (or near-mainline) linux distro and will host an SMB server & DLNA server.

mbreese2• 5 years ago

Why not a 1U Supermicro server? They have options that are short depth or with Atom processors. If you just want a 4 disk 1U server, those would be a good option.

Or is it a question of budget? If that’s the case, what about a used server (like those from UNIXSurplus)?

Or is it a question of power? If that’s the case, then... I don’t quite know in that case.

tremon5• 5 years ago

Like this? http://www.casetronic.com/corporates/40-t1160.html

Not ARM-based though, but they do have a variant that can host 4 pico-itx boards: http://www.casetronic.com/corporates/42-t1040.html . I gather you may be able to convert that one easier to fit an ARM board, or RISC-V for that matter.

Lammy• 5 years ago

iStarUSA make some cases that might suit you. I can't directly link to its search results, but they have a requirements selector here: http://www.istarusa.com/en/istarusa/index.php

http://www.istarusa.com/en/istarusa/products.php?model=EA-1M... (love the "XServe" aesthetic)

http://www.istarusa.com/en/istarusa/products.php?model=U-140...

http://www.istarusa.com/en/istarusa/products.php?model=M-140... (extra short!)

hedora3• 5 years ago

I use synology because I tried many alternatives, and none worked out of the box.

I finally got one (SmartOS; I also tried FreeNAS) working, but I used the intel chip with a timebomb clock line for the build.

Then, I gave up. 4 hours after the synology was home, I was much farther along than I’d gotten in a month on the other machine.

I’d definitely pay a premium for a supported open source + hardware NAS combo that supported docker, vm’s and offsite client-side encrypted backup (with dedupe/compression) out of the box. Also, I want it to draw < 10W, excluding disks.

Until then, synology wins, and isn’t a hobby project.

gh02t2• 5 years ago

iXSystems, the company that develops FreeNAS (now called TrueNAS), makes their own hardware for it with full support and decent prices. TrueNAS has also come a very long way in the past couple of years, before it used to be a bit rough around the edges but it's now a very solid competitor especially running on their hardware.

The one potential downside is it's not as beginner friendly as Synology or QNAP UI-wise, but I actually like that about it as I'm not a fan of the UI on either.

NikolaNovak• 5 years ago

This. I've tried most solutions under the sun, but now that I'm 40 with kids, mucking up with my storage is just not how I spend my weekends anymore.

syshum• 5 years ago

Unraid is what you are looking for then

1MachineElf• 5 years ago

I'd have bought a dozen by now if they'd double the RAM and make it ECC.

highpost• 5 years ago

It uses ECC memory.

https://kobol.io/helios4/

manigandham• 5 years ago

Synology is proprietary UI but it’s just using Linux raid. That’s how you can recover if anything happens to the hardware.

Hamuko3• 5 years ago

Does that apply to SHR as well?

boromi• 5 years ago

Wow very cool. I wish there was an optional 10gbe interface. Otherwise, I wonder how they are able to make this soo affordable.

fonkyyack• 5 years ago

I personally have a qnap Nas because I wanted something cheap. I did not enabled all the fonction and I will definetly not enable all the "internet functions".

ksec4• 5 years ago

Thank You, never heard of it before. The bundle price is really good for a 5-Bay, Battery UPS NAS.

Unfortunately I only want 2 Bay.

squarefoot2• 5 years ago

Many 2 bay NAS cost close to that figure, so it's still convenient, and more bays are never enough. The only two problems with the Helios, which I monitor since last year, is that it appears to be not 100% stable yet, although most problems reported in the forums seem related to excessive clock speed (which can be throttled down), and being always out of stock. It's a revolutionary product given the price and features (how many noticed it also has a small UPS on board?), therefore as soon as a new production batch is ready it goes away almost immediately.

JeremyNT2• 5 years ago

There's also U-NAS, which makes a 2-bay mini itx system. They'll sell you either a chassis or an entire prebuilt (Intel) system [0].

[0] https://www.u-nas.com/xcart/cart.php?target=product&product_...

paol2• 5 years ago

That seems perfect spec-wise. Would you mind giving a quick review of the acoustic characteristics of the case?

(The other reasons are that I'd rather manage ZFS myself, and the need for more than gigabit ethernet)

xattt2• 5 years ago

Another suggestion for QNAP owners is to simply replace the firmware with a regular Linux distribution. This is what I’ve done and haven’t looked back.

JeremyNT2• 5 years ago

Is this commonly possible? I know some of their devices can run a normal distribution, but when I looked into this recently I didn't see confirmation for current models.

zmix2• 5 years ago

Nice box, but "Out of Stock". And no IPMI, as it seems.

knrdjngr• 5 years ago

Is there an official statement regarding the exploit? What should/can you do at this point to ensure access to your data?

gumby• 5 years ago

What drives are people buying these days for moderate-load / high reliability RAID?

tremon5• 5 years ago

I usually use the surveillance-line of disk drives. That's WD Purple, Seagate Skyhawk, or Toshiba S300. Theoretically, their firmware is supposed to be tuned to a higher queue depth and lower latency, which should be beneficial to RAID performance.

Haven't run any performance numbers on them, though.

KozmoNau72• 5 years ago

NAS-oriented drives from manufacturers that don't lie about which disks are SMR and which are CMR. Right now, that means I buy Seagate Ironwolf drives and avoid WD like the plague.

You never want an SMR drive. Just say no.

OldTimeCoffee• 5 years ago

Seagate Exos (x14, x16 or x18) and Ironwolf or WD HC520. Consumer drives, like the Ironwolf drives, are usually more expensive than enterprise. If you have a SAS backplane get SAS because they're cheaper as Chia caused the price of SATA drives to skyrocket.

aborsy2• 5 years ago

It’s worth mentioning that, people found that Synology also has a default encryption password (same password for all devices):

https://blog.elcomsoft.com/2019/11/synology-nas-encryption-f...

The OpenVPN also had a hidden password:

https://www.cvedetails.com/cve/CVE-2014-2264/

The funny thing is that, they didn’t even bother to choose a longer password (the password is synopass). Even if people haven’t found them, an attacker brute forcing these passwords would easily find them.

encryptluks2• 5 years ago

Crazy when things like this happen people even rarely get fired and the company just says "oops, we'll do better." US retailers should stop selling QNAP after something like this. Who knows if this was accidental or intentional.

flyinghamster• 5 years ago

I was on the fence about getting some type of off-the-shelf ARM-based NAS, but once again my wariness of "consumer" hardware turned out to be a good call. I wish it could be otherwise.

My current NAS is an old PC that I built for the purpose many years ago with ECC RAM and an unlocked Phenom II, and currently runs Ubuntu Server after I experimented with OpenSolaris just in time for the Oracle takeover, and then took a detour through CentOS. It's getting kind of long in the tooth now, and I could get a lot more oomph for the same power consumption, or the same for less power.

It's clear that my next server is going to have to be one I build up myself, just as before. I'm leaning toward an AM4 server board (such things do exist), as it offers lots of CPU options from cheap/low-power to Ryzen 9 5950X. The latter is extreme overkill, but it's an option nonetheless. ;) I'd be most likely to go midrange on the CPU. ECC RAM is a no-exceptions must.

I'm on the fence whether or not I should spring for 10G Ethernet. I have absolutely nothing else that uses it right now, and I have perfectly good gigabit gear that has served me well and would rather not throw out or try to sell. It might be worthwhile anyway as a direct single-client SAN.

jploh• 5 years ago

I was close to getting a QNAP as they are cheaper than a Synology. My use case is storing home security camera footage.

Currently, I have an old PC running Linux with software RAID. My motivation to switching to an appliance was power consumption and heat/noise. I live in a tropical country so I can't get away with passive cooling. Due to dust build up, the Intel Celeron CPU and motherboard broke down.

It's been replaced with an AMD Athlon. My plan was to replace the entire setup with an appliance NAS the next time it breaks down. I'm now hoping it will last long enough that an ARM-based CPU solution will work out. My top candidate is the ROCKPro64.

dsego• 5 years ago

I wish I'd built my own instead of buying synology. The added value software is just a gimmick to pad the marketing material, most of it has only the most basic functionality and isn't particularly well made.

bombcar• 5 years ago

10G Ethernet is cheap enough that I made a "mini backbone" using a CRS305-1G-4S+IN and threw my NAS and main desktop on it. It's nice.

__jem• 5 years ago

One of my roommates reset the router and accidentally enabled upnp, which I didn't notice for weeks. Just fixed it a few weeks ago, and seems like I avoided this, phew. I think I'm going to decom the QNAP and just roll my own...

kwdc• 5 years ago

Stopped buying storage appliances when my old drobo went out of support. Now I get a suitable case, fill it with drives and go from there. Even a usb tower with ten drives is far more preferable than some proprietary linux derivative with a downward ticking support window.

I genuinely believe you're better off with a combination of:

A. an integrated solution like freenas/truenas, unraid or even ceph if you want even more steps. Install and configure. Done.

B. a base linux install with just the particular file servers you need. Install and tinker. Auto-update. Remove unnecessary packages.

strictfp3• 5 years ago

How can you tell if you've been hit?

strictfp3• 5 years ago

Found out that QNAP have an official response with instructions, sounds like their malware remover should detect it: https://www.qnap.com/en/security-news/2021/response-to-qlock...

theogravity• 5 years ago

I sold my QNAP NAS a year ago as QNAP does not have a strong security track record. If anyone is looking for an open source NAS solution, I recommend OpenMediaVault - it runs on Debian Linux and provides a management GUI for managing ZFS pools.

I'm currently using a 3 disk setup with WD Red (CMR) drives + SSD cache on ZFS with it and have had a good experience in the past year using it so far. I've had to replace one of the disks due to age and ZFS makes it super simple to replace and resliver disks.

lmilcin• 5 years ago

Hey, at least they did not remove the posts from the forum and ban the author, like Apple does regularly.

QNAP ships NAS backup software with hidden credentials

Related Stories