im been getting these alerts from Netgear Armor my setup : orbi rbr850 and readynas 316

neoprodigy wrote: im been getting these alerts from Netgear Armor my setup : orbi rbr850 and readynas 316 Are you forwarding any ports to the NAS from the router? Is the upnp service enabled on the router? FWIW, the IP address in your picture is in Singapore.

1. dont think so2. dont think so I check my netgear armor been constant attack. and they are all different ip addresses. let me know what I need to do. thanks

neoprodigy wrote: 1. dont think so 2. dont think so You need to know for sure. Go into the Orbi web ui. Select "advanced" at the top, and then select "advanced" again from the side menu. Select UPnP from the left menu. If "Turn UPnP" is checked, then uncheck it and select "Apply". Then select Port Forwarding/Port Triggering from the same left menu. See if there is anything forwarded to the NAS. Make sure you click "Port Triggering" after you've checked "Port forwarding". neoprodigy wrote: let me know what I need to do. thanks Also, let us know what apps are running on the NAS. A torrent app is one possible vector for these attacks (but there could be others).

neoprodigy wrote: seem like this one works? Did you check the upnp and forwarding/triggering as I suggested? Also, did you look at the apps you installed on the NAS? Any torrent app could expose you to these attacks, and perhaps others as well. Blocking all services is a bit extreme. You are blocking both NTP (time synchronization), and check-for-updates. While you could do this as a stop-gap, it would be better to understand what is allowing these attacks in the first place, and close the underlying vulnerability.

Brute force attack on ReadyNAS 316

20 Replies

Replies have been turned off for this discussion

StephenB
Guru - Experienced User
Sep 21, 2022
neoprodigy wrote:

im been getting these alerts from Netgear Armor

my setup : orbi rbr850 and readynas 316

Are you forwarding any ports to the NAS from the router?

Is the upnp service enabled on the router?

FWIW, the IP address in your picture is in Singapore.
- neoprodigy
  Aspirant
  Sep 21, 2022
  1. dont think so
  2. dont think so
  
  I check my netgear armor been constant attack. and they are all different ip addresses.
  
  let me know what I need to do. thanks
  - StephenB
    Guru - Experienced User
    Sep 21, 2022
    neoprodigy wrote:
    
    1. dont think so
    
    2. dont think so
    
    You need to know for sure.
    
    Go into the Orbi web ui. Select "advanced" at the top, and then select "advanced" again from the side menu.
    
    Select UPnP from the left menu. If "Turn UPnP" is checked, then uncheck it and select "Apply".
    
    Then select Port Forwarding/Port Triggering from the same left menu. See if there is anything forwarded to the NAS. Make sure you click "Port Triggering" after you've checked "Port forwarding".
    
    neoprodigy wrote:
    
    let me know what I need to do. thanks
    
    Also, let us know what apps are running on the NAS. A torrent app is one possible vector for these attacks (but there could be others).

Forum Discussion

Brute force attack on ReadyNAS 316

20 Replies

Related Content

Brute force password attack originating from RBR50

DOS Attacks

DoS Attack

DoS Attack: Land Attack

False Positive DoS Attacks

NETGEAR Academy

ProSupport for Business