ReadyNAS Vault using rsync??

StephenB wrote:
If you never enabled ssh, then the root password is the same as the admin password - and you changed them both. If someone could see the dataflow on the path to the destination, then they could theoretically use rsync (spoofing the IP address). Though I think it is more likely that rsync terminated on the IIC Internet server.

I was able to change the admin password early in the morning remotely, and now checking for the NV+ logging into the network via VPN (only 1 of 2 certified users to the network) - not able to access the unit.

No pingbacks received from the IP either.

Also, if I ping/tracert this IP, it comes back to: server.iicinternet.com [64.64.131.102], with a last hop in Dallas: GLOBAL-INTE.edge9.Dallas1.Level3.net [4.30.68.182]

No idea if the hacker just shut down the unit now that I attempted to thwart his stealing our info.

Will post once I get into the office.

(I also tried calling the contact number for iicinternet, was kept on hold for a *long* time, using both their normal and 800 numbers - no response. Shell company of some sort??)

StephenB wrote:
Are you certain it was on the NAS, and not someone else in the company using rsync for something else?

100% sure.