QNAP Systems, Inc found a new DEADBOLT ransomware attacks that exploits zero-day vulnerability in Photo Station. QNAP urges all QNAP NAS users to update Photo Station to the latest available version.
“QNAP® Systems, Inc. today detected the security threat DEADBOLT leveraging exploitation of Photo Station vulnerability to encrypt QNAP NAS that are directly connected to the Internet,” security notice from QNAP.
The company noticed DeadBolt ransomware campaign on September 3rd, 2022. “The campaign appears to target QNAP NAS devices running Photo Station with internet exposure”, QNAP.
The company did not share CVE for the vulnerability however the company fixed the Photo Station vulnerability within 12 hours of its use by DeadBolt actors and advised users to take a range of actions to protect themselves, including making sure their devices are not exposed to the internet.
A surge in DeadBolt submissions to ID Ransomware (BleepingComputer)
The attacks were extensive, with the ID Ransomware service seeing a surge in submissions on Saturday and Sunday.
Patches Released
- QTS 5.0.1: Photo Station 6.1.2 and later
- QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later
- QTS 4.3.6: Photo Station 5.7.18 and later
- QTS 4.3.3: Photo Station 5.4.15 and later
- QTS 4.2.6: Photo Station 5.2.14 and later
The company says that QuMagie is a simple and powerful alternative to Photo Station. Therefore it is recommended using QuMagie to efficiently manage photo storage in your QNAP NAS.
How to Protect your NAS from the DeadBolt Ransomware?
- Disable the port forwarding function on the router.
- Set up myQNAPcloud on the NAS to enable secure remote access and prevent exposure to the internet.
- Update the NAS firmware to the latest version.
- Update all applications on the NAS to their latest versions.
- Apply strong passwords for all user accounts on the NAS.
- Take snapshots and back up regularly to protect your data.
