Massive Botnet Attacking Synology - how to protect your NAS

[@Supermanohman]

Will last September when I got my 923+ I went through your setup videos on security when setting up mine, basically word for word. I paused after you mentioned changing a setting, changed it myself, and then continued on the video. Your help is better than the Synology's official help which is usually the case with a hardware company.

[@GraffHabit]

That’s because you are not paying for synology support. It’s not something that makes sense for them to provide for free. Will isn’t providing it for free either, he makes money when people view his videos.

[@avotius]

Thanks so much for your videos. I recently got a nas after doing some research and your videos convinced me that Synology was the way to go for me because of how comprehensive DSM is. Your setup and security tutorials have been invaluable for me!

[@Saintel]

OMG watched this video to learn about the Botnet attack. While watching saw that I had used these same firewall rules mention to block access for countries outside the US. No wonder my apps were not working when I traveled. Thanks for the indirect help! You are man!

[@nospamevereh]

Used many of these easier methods on two NASs. One fw 7.2 the other fw 6.2. Virtually no issues on 7.2 from the start but tons of attacks on the 6.2 unit. admin and guest were disabled from the start and the autoblock helped me sleep at night but I had logs of multiple RSYNC attacks from the same IP and then cycling to other worldwide IPs with China and Russia topping lists. The addition of firewall and account protection caused the attacks to cease completely for the past 11 days. Looking at swapping out the remote 6.2 unit for a 7 series soon to further bolster security but for now, all looks quiet. Excellent information much of which I had put into practice already but relatively simple to implement and works very well!

[@leexgx]

In dsm 7.2 the block list extends to quickconnect so blocked at Synology end and by default doesn't enable portforward via UPNP Also it's quite easy to get list of Synologys that have quickconnect enabled

[@mar4kl]

Good, comprehensive information - thanks. For my NAS clients, I keep remote NAS access disabled, largely for this reason. I only have one client that requires remote access to anything on the NAS, so I have them set up so they have to connect to their office LAN via VPN first, and only then can they access the NAS. This works fine for them largely because they're a small office that doesn't share data directly with anyone else. (And, of course, I keep my NAS clients comprehensively backed up because, well, bad stuff happens...)

[@barryfarrell8588]

Thanks. reminders on good security anre always appreciated. I especially loved the simple firewall suggestions. Adopted. I accidentally typed 196.168 instead of 192.168 and the NAS would not apply the rules because it woul block the computer making the rule change! Quite impressed.

[@SpaceRexWill]

The Synology firewall rules are actually really good about that kind of stuff! I have always been pretty impressed by how well they work

[@NeilBradleyMS]

Thanks for this great video, I've since enabled Account Protection on both my NAS's as the other options I'd already got enabled. I now feel extra confident my data is secure from attack. It was also interesting to learn how the attacks take place with the multiple IP Addresses etc. I don't comment much, but I've been a subscriber back in the day when you had about 25k,subs so it's really really nice to see you channel growing and doing well. All the best - Neil (UK)

[@brianhansen6906]

I'm really glad I found this video. I just watched your maintenance video posted yesterday and through that found out I had a botnet attack on my system 2 months ago. I was a little concerned to say the least. I was also confident my system and data were safe. I long ago put all security measures in place that you recommend along with snap shots to save my ass if they did get through and encrypted stuff. Sometimes I forget that DS920+ is even there chugging away in the closet because it's always just "there" when I need it. Every single time. Thing never fails.

[@Norman_Mitchell]

Brilliant video. You covered a lot of ground with just the right amount of detail. Excellent.

[@wesc6755]

I'd also point out Synology's Active Insight might be helpful here. That's how I was notified about the ongoing attacks. We got that exact attack from around the beginning of the month. SSH attempts happen fairly often, but this was the first time I saw DSM targetted on that scale. I set aggressive permanent IP blocking, and they all only ever tried the "admin" account. It has been several weeks with no more attempts.

[@donaldhoudek2889]

Part of the problem is that when the computers that were infected with the botnet are located here in the USA and generated from a foreign country, the foreign countries being blocked will be ineffective as they are US IP addresses. They also seem to use VPN. With my UniFi UDM-Pro I took security one step farther. I have utilized all 150 UniFi max of countries to block, but there are 195 countries on this planet so there will always be about 40 unblocked unblocked countries. Working with my UDM-Pro's Security Detections log I have fine tuned the list based on the LOG with the countries that have more than 1 attempt. I also noticed that the CIARMY also uses specific blocks of IP addresses based here in the USA and a majority of attempts are by IP addresses with the same first 2 octets (22.239.0.0/16) of the IP address. I took the UDM-Pro's "Critical Security Detection" log and created a rule that blocks all the traffic from the log's IP addresses within the first 2 octets. Seems to be working fine! Great video.

[@AaAa-je5eo]

More incredible content, thanks Will. And the SpaceRex team is hurtling towards 100k subscribers, getting very close now! I wonder how AI will affect their attempts at 'brute focing' thing, or really just tactics for approaching what they are trying to do. As with everything AI supercharges, you'd think it would also be of benefit to them too in some way...

[@donaldhoudek2889]

I am sure that AI will soon be used to look at your IP address and check the Dark Web for all the passwords that you have used on prior sites that have been hacked and based on your password structure it will generate a list to use on your other devices. It is just a matter of time

[@JohnDavidSullivan]

I am still running an old Synology NAS but I am definitely considering upgrading in the next year. That said I really like your channel Will, it's helping be better informed and more aware of what's going on in the NAS space. So I just want to say thanks.

[@SpaceRexWill]

Really appreciate it!

[@JohnDavidSullivan]

@@SpaceRexWill 🙏

[@blcjck8121]

There's one more thing to consider. Reverse proxy, is a great way to limit your exposure down to just one port. This is great if you have multiple services running. Also if you choose a specific LAN interface to configure, instead of all, you have the option to just switch interfaces should you be unlucky enough to lock yourself out playing with the firewall rules.

[@tjwreds1]

This is the only acceptable way to do it imo. I still would like to understand why anyone would put their personal/small business nas exposed to the internet.

[@jeffreytotaro7051]

Thanks Will! Excellent video!

[@SpaceRexWill]

Thanks Jeffrey!

[@cookie13spike]

You had me worried for a moment! Checked my logs and no drama :) As always great content and I had already done most of the things you suggested from previous tips from you!

[@DavidM2002]

This made me go through all of the protections that I have set and, I'm happy to say that, other than Account Protection, I had everything setup correctly. ( I also had the geo-block setup on my Synology router.) I hadn't realized that Synology had automatically enabled Adaptive MFA at some point so I was a bit shocked one day when I got the email alert. This has been a great exercise and one that we all need to review periodically. As a slight aside, even though I am mucking about in the Control Panel fairly often, I can easily forget what settings that I've changed, when, and why. So, I have gotten into the habit of keeping an Excel spreadsheet on all of this stuff for all of my devices. A bit anal, yes, but very effective. But it keeps things consistent around my network. It would be so nice if some of these devices would allow the export of all of their settings into something like a CSV file. May thanks again Will.

[@TSSC]

A diff analysis tool (current vs default) is a feature that sadly is missing in most equipment.

[@agentsmithone]

Excellent tips. I've been on Synology NAS models for 13 years. Very to see I'm doing the right things to security harden.

[@turbo_bikini]

Good very learning you.

[@rohitdhage7976]

Excellent video. I subscribed to your channel. Very helpful demonstration and clear explanation. Also you cover evertthing that is necessary.

[@alfonsoedgardo5407]

Really useful. Thanks, implemented the firewall rules and feel much safer )

[@dennisvanlith]

This is the most common secure settings you need to have. One more level to secure the NAS, is by only allowing it to connect it to your local network, and setup a VPN to get into your network when you're remote. You might need an upgrade on your modem (like Unifi)... This way even the most skilled hackers won't be able to get into your NAS so easy.

[@patrikuhl]

Thank you for this video, it helps me a lot with the large number of attacks.

[@hassan_ksu]

Please talk about securing the Nas physical. I just realized recently that the buttons on the back can activate and rest the admin password, meaning anyone that can steal your nas physically will have access to all your file. This is really dangerous and there is a solution for that. In the system settings, under "System Reset," there's an option to "Keep Admin Password Unchanged." Activating this option ensures that if someone tries to reset your NAS, they can enable the admin account but won’t be able to reset the admin password. To implement this, you need to change your admin password and select this option. Some might argue that the files are encrypted. However, if you have auto-mounted files and the thief resets the password, they would still have full access to everything. Therefore, taking this additional security measure is crucial to protect your data.

[@jemmrich]

Great advice! I had no idea that feature existed, I found it in Control Panel > Update & Restore > System Reset

[@hassan_ksu]

@@jemmrich just make sure to never ever ever forget admin password as you will not be able to rest it if you lose your normal administration account and also forget the admin password that you just changed. I would advise to add it somewhere in your phone or Google cloud or any other cloud so if you forgot you can go back to it. The admin is not visible unless you push that button for 4 seconds. Add it to Google cloud as no one will have access To the admin account unless they steal your nas and hack your Google account.

[@Dragonx21]

Encrype your shared folder. Folder won't mount without the password

[@hassan_ksu]

@@Dragonx21 yes, but if you don't active key manager (auto-mount) every time you restart you have to sign in and mount all the file.... To do what I mentioned is way easier but just don't forget your password ever.

[@rayjaymor8754]

@@hassan_ksu I've never understood people that encrypt their drives and then have them auto-unlock. As you've said it basically doesn't protect you from physical theft at all. My NAS is all encrypted with a passphrase needed at boot. If someone steals my server they aren't getting $#!^.

[@Pattot818]

Realy helpful appreciate your work, thank!

[@rossmyers8448]

Good video Will, it finally prompted me to disable the default 'admin' account and set up a new one......I mean Synology has been nagging me to do that forever!

[@markasiala6355]

The Security Advisor app also checks a few key basics. Also useful to let you know what packages (or DSM) have updates. It is a good starting point and then go through the items listed in the video to the extent they apply (beyond the generally applies to everyone items).

[@gregf9160]

Will, great tech advice as always -- and of course, great hair 👍

[@napynap]

So timely for me right now. Thank you for this!

[@binarypatrick]

You mentioned Tailscale when setting up the firewall rules. The built in firewall won't block tailscale as it's an outbound and then established connection. Synology's firewall rules only effect inbound connections.

[@Canadian_Living_in_Mexico]

Thank you for that security update.

[@robinmoret]

Very useful video, thanks Will ! Are you running Graylog as a container on a Synology ? If yes I would be very interested on a video on how to setup a Graylog install 😇 !! Keep on doing what you do (and keep on with the nice shirts) !!!

[@ricardojannuzzi7440]

I would like to learn too.

[@frank-hilft]

Thank you, that was very informative.

[@MikesTropicalTech]

Thanks, I checked the logs on my 920+ I didn't see anything unusual in the logs. I had already disabled admin and guest. Looks like everything is good. Great tutorial!

[@Arcao]

A proper router with IDS/IPS is a must have these days. In addition to blocking any port scanning on your public IP, it is also critical to block the IP ranges of known attackers, C&C, botnets and scanners like Shodan.

[@alank1995]

Another great video Wil! If you change your ports from the default (5000/5001), would that cause issues with existing external services such as Plex users? Most of the stuff you outlined here I've already done because of your past videos but I'm also going to look into geo-blocking as well. Thanks for the info!

[@SpaceRexWill]

Plex operates on an entirely different port! (32400 by default) so it will not mess this up.

[@alank1995]

@@SpaceRexWill good to know. Thanks for the reply!

[@john_in_phoenix]

I recommend changing the default port for Plex as well, even though security through obscurity doesn't really work well for targeted attacks.

[@thecrimsonraven707]

Thank you for the information! As always a great video.

[@tontenkink3452]

You scared me with your title. I thought I missed a new threat. Like they were a few years ago. Especially at Qnap. To be sure, I took my 920 offline. This is because I heard the HDD more often than what is normal for my use. Today I had time to watch your video and I saw that almost everything you described was prepared for me. :-) I'm only going to use Tailscale. Completely relieved! Thanks for al your great video's

[@novelmartinez6154]

You sir are a godsend! Thank you so much!

[@JingerVideo]

Thanks so much Will!

[@sooo0kie]

Great and absolutely essential video again Will. What I'd add is to set a high security profile in Security Adviser, it takes some time to get all the green checks but well worth it. (-;

[@erikheidt4949]

Thanks for sharing this great information !

[@dallasivanko2200]

The one caveat to having MFA for administrator accounts is if the volume fails for some reason MFA will top functioning and it becomes necessary to go through a password reset for the admin account, the failure of the volume creates a configuration issue and you are alerted that MFA cannot continue due to a configuration issue when trying to login. I learned this the hard way by experiencing this very issue. I love to use MFA; however, if you are working with a remote NAS and experience this issue it can be a pain.

[@Emulives]

U SCARE ME NOW !!! ...thank God in the first minute you calm me down

[@mohammadabuhejlih5708]

Thank you.. This is really useful and in an easy and beautiful way

[@tjmitchell42]

Thanks for the video. Checked my logs and earlier this month and last month had thousands of attempts on mine. Very scary.

[@pedrohermida7080]

Another great video. Thanks Will. You may have done it already, but if you haven't, please consider creating a video about graylog.

[@dennisvanmierlo]

I do miss two other very important points that protect your from a hack: Backups and Snapshots with an immutable period configured.

[@Shocker99]

These help recover you from a hack - not prevent it.

[@MrCoffis]

They do protect your data from being taken as ransom. So they protect you too for not having to pay that ransom. Because zero day hacks are a thing and have happened in the past.

[@darrenoleary5952]

Backups should be a given anyway for any NAS user, but if you have the basics of this video implemented - don't have an administrator account called "administrator", strong passwords on any admin and/or service accounts, 2FA/MFA and change default ports, then you'd be fairly well covered for any unauthorized attempts.

[@Shocker99]

@@MrCoffis Backups do not protect your data from being taken.

[@MrCoffis]

@@Shocker99 I said they protect you from having to pay ransom. The whole idea of a ransom attack is to take your data as hostage and pay them money to decrypt it. If you have a backup you protect yourself from being a victim of a successful attack. Zero day hacks can happen anytime no matter how well you set up your security. A back up protects you from all unforeseeable events that can happen. Even a fire and other natural disasters if you follow the 3 - 2 - 1 rule. Some hacks or loss of data are unpreventable and back ups are the only thing that can protect you from losing your data. Loss of data is what you are trying to avoid.

[@sygad1]

thanks for the update to best security practises

[@US_Joe]

Outstanding post! - Thanx Rex 👍👍👍👍👍

[@OfficialDJTazer]

19:18 How do I source the local IP addresses that I would like to include?

[@inellly]

Always appreciate your tips 👍🏿

[@turbo2ltr]

The most obvious one, don't open port 5000 to the internet. While this is the first line of defense, it's not the only one as if you have a compromised device in your network, they can use that to bypass the firewall. But that takes a lot of effort on one specific target. Not the MO of the these botnets..

[@streamproperty]

Great video Thanks So Much!

[@bobcat6653]

Thanks Will, where specifically in the DMS Control Panel did you see a Log of the the login attempts at the very beginning of this video?

[@SpaceRexWill]

under logs!

[@N0BIgDEal]

What news outlet are you using? Of course, I'm aware. that there are always attacks going on, but I'm not finding an article right now about a massiveogy. Could you please share the link?

[@SpaceRexWill]

For me I have just been tracking them with my severs that I manage for clients

[@N0BIgDEal]

@@SpaceRexWill Thanks! It was driving me nuts to not find a single threat on the news :)

[@waynekremer1649]

No mention of Tailscale?

[@its_me_again_again]

Thanks for this!

[@aaronhubalik7696]

Should I enable, "Trust This Device," in control panel? It skips the 2-Step athentication protocol.

[@male3083]

Is it ok to add your home local network IP addresses and subnet mask to the allow list?

[@Morpheus2515]

Great vid 👍👍👍.

[@ElectroCurmudgeon]

great important info. always count on being attacked. great tips.

[@chris_outdoorchraft]

Hi Will thanks for this awesome Tipps. Just found out DSM 7.2 will show you it is up to date but when you actually check on their Website I could update to 7.2.1 😮. So I did this imediately. Also you could mention to have Backups, just in case.

[@K24Z3CU2]

21:25 @spacerex Question: When locking down NAS to location - would this affect QuickConnect if that is located in the US?

[@SpaceRexWill]

Quick connect follows firewall rules now!

[@WeiKunTeo]

How you miss to enable Denial of service (DoS protection) ?

[@Verserve]

Great video! If I only connect to the NAS outside of my local network via Tailscale VPN do I still need to consider changing the default port?

[@marcowaldmeier]

Thx a lot - very helpful

[@davidkuntz4295]

I have an external hard drive with all my music on. I would like to know how to add that external hard drive to back up to Nas, via Time Machine, which my computer is backing up to NAS.already.

[@nzed316]

do you have tutorials on creating port forwarding for Synology router to help it to be safe from hackers?

[@theworldaccordingtotreris]

Have closed the firewall for traffic coming from e.g. China and similar countries, with autoblock enabled and admin account disabled. Ports 25 and 5001 are actually open for my mailserver and friends and family logging into my server without VPN and haven't had a malicious login attempt for weeks. PS the blocklist from Marius Hosting also helps a bunch I guess.

[@yanniclolheimer8760]

What monitors do you use? ☺️

[@ShadowHawk99]

random question? what is the brand and model of you screens on your desktop?

[@carstenskjoed9026]

Du you really need to use Quickconnect if changing the DSM port, to get access to DS audio, DS Cam, and DS cam.?

[@MDRaju-zq8lk]

Thank you for the tips. But what about using reverse proxy?

[@andrejkrieger4617]

❤ thanks so much!

[@arthurarts]

Super helpful!

[@JamesOrlowski]

Where do you look at the login attempt logs file?

[@georgec2932]

Crazy to be opening up such an important device to the internet when a VPN server is so easy to setup. I access everything on my home network through a VPN. The only port I have exposed externally is for the VPN and I trust Wireguard security much more than I do Synology and other common services. Also having completely offline backups allows you to recover from a ransomware attack if it happened.

[@SpaceRexWill]

Comes down to the clients use case A work with a ton of photographers / videographers who want to use it to send clients videos. And you can’t do that over a VPN Really just comes down to use case / how sensitive the files are

[@Iris-vq9ih]

All depends on use case. If you have multiple family members and friends that have access to certain features in the NAS, VPN's won't cut it. It's far too cumbersome to setup and maintain vs direct access to the NAS

[@georgec2932]

@@SpaceRexWill Yeah, that's an interesting use case I hadn't considered and I can see how it drives the need to expose it to make life easier for everyone involved. I use Tailscale to join a NAS I have at a family members house as it requires less network configuration at their end but I appreciate that isn't going to work at scale for the use case you've highlighted. If I had a need to expose it then I'd be taking steps to reduce the threat of an attacker traversing through the network if the NAS was compromised, but appreciate that comes with trade offs between functionality and security too. Like you've said the main risk is if a zero day comes out affecting DSM, however if you're responsible for them and can patch them in good time then it mitigates the risk considerably. Thanks for responding 🙂

[@ToreSimonsen]

Thanks for great information. A quick question about the FW rules. I use portainer (as I think you do to 172.16.0.0 ?). When I have more stacks/networks inside portainer, do I need to add the additional networks to the FW ruleset as well? (Ie. 172.18.0.0 - 172.20.0.0 ...)

[@SpaceRexWill]

The firewall rules that I wrote here will cover the entire 172.16.0.0 - 172.31.255.255 private address range. It's the way that subnets work. 172.16/12 means the exact same thing as above. RFC1918 are you local LAN addresses: netbeez.net/blog/rfc1918/ (you would not want to create a 172.33.0.0 subetnet for docker as this would be a public IP)

[@ToreSimonsen]

@@SpaceRexWill Ahh, I understand. Thank you!

[@keithbales2616]

When I added the country rules, I could not get in with my DDNS subdomain, only local IP. I had to allow Taiwan in addition to USA, and then it worked. Since the Google-Squarespace domain sale, I've had to use Synology's DDNS service, which server is based in Taiwan...

[@crazyjrp]

I already did everything else, except for the firewall rule and changing the port number. I tested on my smart phone and made sure I am able to access the NAS.

[@bagais_ab]

thank you very much

[@DingusBatus]

You’re not weird, not only did I deactivate the admin account I too change the default password for it.

[@jodiannkarambela4946]

Wait, are you recommending deleting the "admin" user?

[@SpaceRexWill]

No, just disable it

[@jpny4750]

Is there a way to block LAN access from Synology, but allow access from LAN into Synology NAS?

[@TheCynysterMind]

also a 2nd admin account is helpful in case the primary gets locked up from hacker trying to access it

[@jasonpower6769]

What about the Denial-of-Service (DOS) Protection, would that be something that should be enabled?

[@SpaceRexWill]

That is not this. Its if you get ddosd

[@jasonpower6769]

@@SpaceRexWill yes but should it be enabled as good measure I notice it was not mentioned in the video?

[@henryschroer]

Very good information. Question: if you disable admin and admin has tasks, how can you transfer the tasks first to another user?

[@PhoenixNL72-DEGA-]

Basic Preventive measures (posting before watching the video): 1) Disable the default admin account on a synology (create a different user with Admin access) 2) Enable 2FA for any accounts with admin priviliges 3) Do not forward port 5000-5001 to your NAS. If you want to access DSM remotely install the VPN service and first connect to your Synology over an OpenVPN connection. 4) Turn on Account Protection in the Security Options 5) Only forward ports you specifically need to be able to access from outside of your LAN to your NAS. (Should be obvious but I'm sure there are people who have forwarded the entire range of available ports to it) Now lets see if there are any important ones I missed.

[@razorree]

of course blocking Admin account, but then, adding reverse-proxy, adding geofence and banning IPs which try to login for some users like 'admin', and try to login a few times, or even if requests results in 4xx errors. Is it enough then ? Helpful vid ! thanks !

[@ahmetmyuksel]

Hey, great video! thanks for the explonation and nice demo. Do you also have a special discount code or agreement for Europe(Netherlands) Synology?

[@GSingh-04]

Hi need help After change my phone i don't have access to Synology by quick connect . The Secure Signin code gave me error if i disable from account app still ask for code and code didn't work.

[@ThePsychoKillers]

Not very network savy but wondering why you have 3 different ip address on your local network when blocking outside countries. Is there something That I need to look for when setting mine up?

[@SpaceRexWill]

So those three subnets are the local subnets. Basically any of those, can not come from the internet, they had to come from the local network. So if you dont know about subnets, add all three, because your network will be one of them

[@g04tn4d0]

Ah, I noticed that happening to my new one at home. Just sad little brute force attempts. I set it to fuck up twice, banned. It went on for about a week and then stopped altogether.

[@infoamh]

How to disable File Download ? and the i did the disable file download user can't open the file Why like that?

[@MrBoboka12]

Yes, its very very important to have your most valuable personal data to have available 0/24 on the internet. 1: Never allow NAS internet access for any reason. Not in not out. Period. 2: See 1

[@endotherm]

With geo-blocking, will this prevent Synology tech support from remotely logging in (if they are from a different country)? Or do you need to remember to disable that first before requesting support?

[@SpaceRexWill]

You would need to get their IP and allow it

[@LC-od4qs]

Hello there, I’m gettin SMB attempts? How is that posible? Does it means that I have a mole in my network, who is trying to brutforce my Synology Nas?

[@SpaceRexWill]

It depends heavily on them. Are they SMBv1? or are they real login attempts?

[@leexgx]

Make sure you haven't enabled DMZ on your router and don't setup router under external access in dsm Dsm7 accepts any username and password when 2fa is enabled so they won't know if they have a valid username or not (always make sure 2fa is enabled as number of people have had there nas encrypted because 2fa wasn't enabled) don't use email code generation use push or MFA code generator (use authy as it allows syncing between phones/tablets)

[@LC-od4qs]

@@leexgx Thanks a lot! I will do it like that.

[@ckckck12]

You're the best dude!

[@ecotts]

How many more Synology and Qnap vulnerabilities do you people have to have before you stop using their overly vulnerable operating systems or in house apps.

[@tracyscott6103]

I solved my synology slowness problem by shutting down the server, moving the drives to another server box, and installing Unraid while adding a 10g Nic and switch. My Synology was a 420j and was getting old.