SoylentNews

UK/US Governments Warn of QNAP NAS Malware

posted by Fnord666 on Wednesday July 29 2020, @12:22PM   
from the snatching-your-data dept.

upstart writes in with an IRC submission for RandomFactor:

UK/US Governments Warn of QNAP NAS Malware:

The UK and US governments have issued another joint cybersecurity alert, this time warning organizations about a strain of malware targeting network attached storage (NAS) devices from QNAP.

As of mid-June, the QSnatch malware (aka "Derek") had infected 62,000 devices worldwide, including 3900 in the UK and 7600 in the US, according to the notice from GCHQ's National Cyber Security Center (NCSC) and the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).

This is the result of two campaigns, one running from 2014 to mid-2017 and the other starting in late 2018.

[...] QSnatch apparently features a credential scraper, SSH backdoor, CGI password logger, webshell functionality and the ability to exfiltrate a predetermined list of files, including system configs and log files.

It is said to achieve persistence by modifying the system host's file to redirect domain names to out-of-date versions in order to prevent updates from installing on the NAS device itself.

The NCSC/CISA urged administrators to follow the guidance issued by QNAP last November.

[...] "Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable."

---

Original Submission

• I Got The Memo... (Score: 0) by Anonymous Coward on Wednesday July 29 2020, @05:56PM

  by Anonymous Coward on Wednesday July 29 2020, @05:56PM (#1028200)

  In an email yesterday: https://us-cert.cisa.gov/ncas/alerts/aa20-209a [cisa.gov]

  What you should do if you have such a device:

  Mitigations
  As stated above, once a device has been infected, attackers have been known to make it impossible for administrators to successfully run the needed firmware updates. This makes it extremely important for organizations to ensure their devices have not been previously compromised. Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable.

  The usual checks to ensure that the latest updates are installed still apply. To prevent reinfection, this recommendation also applies to devices previously infected with QSnatch but from which the malware has been removed.

  To prevent QSnatch malware infections, CISA and NCSC strongly recommend that organizations take the recommended measures in QNAP’s November 2019 advisory.(https://www.qnap.com/en/security-advisory/nas-201911-01)

  CISA and NCSC also recommend organizations consider the following mitigations:

  Verify that you purchased QNAP devices from reputable sources.
  If sources are in question, run a full factory reset on the device prior to completing the firmware upgrade. For additional supply chain recommendations, see CISA’s tip on Securing Network Infrastructure Devices.