Ransomeware blazing around the world

It's my understanding that the problem in this case is that users haven't been installing Windows updates (Microsoft has already released a security fix quite a while ago) and have been infected due to an old flaw being exploited. It's your choice whether to install security updates on your PCs or not. Another key common cause of malware infection, namely clicking on a suspect attachment in an email on your Windows PC, we can't stop you from doing either.

We don't run Windows on our NAS units. Our OS is based on Debian Linux.

 

There are two very different possibilities with ransomware:

1. A PC on your network gets infected and encrypts your files on your NAS e.g. via a mapped network drive

2. Your NAS gets directly infected

 

With possibility 1, snapshots (on OS6, note these are very different to the snapshot on RAIDiator) can help both on the NAS and on any backups that you have. On current firmware we keep the last two automatic snapshots if we have to delete the older snapshots to keep volume usage down below the threshold you've set (by default to try to keep volume usage below 90% full or if you last factory reset on very old firmware 95% full).

 

It's important to note though that with some use cases snapshots don't work very well. There is the option to enable/disable snapshots for each share/LUN.

 

With possibilty 2, a hacker could potentially do anything on your box if they have obtained root access to it. Of course it's possible that possibility 1 could lead to possibility 2.

Consequently we'd recommend that you consider the risks and take appropriate steps to backup your data. Backups directly from one NAS to another, but also backups to USB disks or tape that are disconnected and "offline" would be a good strategy.

 

If you are comfortable with backing up to CLOUD providers it's possible they may also have taken steps to be able to recover their customers data from backups if they are hit by a ransomware attack. Note though if you store the only copy of data on one Cloud provider you shouldn't consider it backed up. They would have clauses in their T&Cs indicating that they're not responsible for data loss. Bi-directional syncing if used would also mean that any changes made are replicated to all the devices.

 

It's important to note that ReadyCLOUD on our NAS is quite a different thing from a CLOUD provider that stores your data in a remote location (I was referring to the latter above).

 

If in the worst case your online backups are completely compromised the offline backups hopefully will still be O.K.

 

If your systems are infected it's best to shut them down ASAP to limit the spread of the infection. We do have a volume read-only mode that can be used to copy off files that aren't infected (with possibility #1 and perhaps even possibility #2) if you catch things in time.

 

Some work has been done on 3rd parties on figuring out how to decrypt files encrypted by various malware strains. If you've been infected by an old strain or don't need the data back urgently you may be fortunate and find that some time down the line (could be a long time) that such a tool is released for the variant that attacked you, but it may not.

 

Ultimately you need to decide what level of risk you're comfortable with. It's your responsibility to make sure you have sufficient backups to protect against various problems (ransomware is just one of these). It's certainly much better to consider this before running into problems than wish you had afterwards.

There are various things you should consider including but not limited to: a strong firewall, running anti-virus software (may help with identifying suspicious files before they are opened), and locking down write access to shares or subfolders/files to only those users who absolutely need it. The malware can't encrypt files on your NAS if it's unable to gain write access to them.

There's things like setting a strong password, not forwarding ports that you don't need to etc. as well.

 

You may wish to consult 3rd party experts for their opinions and advice as they might be able to give you some helpful further suggestions.

 

If you believe you've identified a security threat with any of our products we have instructions for reporting it here.