NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Network flooding from ReadyNAS Pro 6
Hello there!
We are using a ReadyNAS Pro 6 in our company. But today it suddenly decided to go haywire.
It flooded our network with more than 60.000 Sessions, all to chinese ip addresses. Does an...
What firmware is this NAS running?
what apps (if any) are running on it?
Is access to the NAS over the internet allowed?
In general, if the NAS has been compromised then I suggest doing a factory reset, rebuilding the configuration, and then restoring data from backup.
Thanks for your quick answer.
The NAS runs firmware version 6.10.0 (RC2)
Enabled Apps are:
- Shell in a box (1.0.0)
- SMB Plus (1.0.8)
- Tftp Server for Readynas (1.0.3)
The internet access was cut off around 4 hours ago via firewall policy.
Resetting the device is currently not an option because we first have to move something around 3TB of data.
But I just got new intel from my colleague:
It was not another NAS that made the same problems a year ago, it was this very NAS. And it was resetted a year ago. It's almost like a haunted device.
GUDECO_IT wrote:
It was not another NAS that made the same problems a year ago, ... It's almost like a haunted device.
Shell-in-the-box could be the vector, especially if web access over the internet is possible.
Thank you again for your quick answer :)
We deactivated and deleted the SIAB app and enabled internet access (for test purposes).
But again the NAS started what almost looks like a DDOS attack against the same IP and created about 100 mbps outbound traffic.
After rebooting the NAS it now starts around 1000 sessions to a chinese DNS server (114.114.114.114), the Google 8.8.8.8 and the Google 8.8.4.4 DNS server but NOT to the IP address mentioned in my first post so disabling and deleting the app solved about 90% of our problem :)
After disabling the internet access again and ending the sessions in the firewall it went back to normal.
Next step would be the factory reset which we will try to do maybe as early as this week.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
