ReadyNAS Ultra 4 is slowing down my entire network LAN & WAN

As an update, by preemptively blocking the blocks as instructed by StephenB, I was able to successfully reconnect the second ethernet jack. I tried enabling jumbo frames but that didn't seem to help, it didnt completely destroy the network as before, but accessing the NAS was slow. I think the jumbo frame issue is unrelated to the hacking matter and might be more of a cabling and hardware issue on my end.

Additionally, I viewed my routers "Block services" page after StephenB's instructions and noticed it was blocking access to ports that it categorized for use by the programs "Age of Empires" and "AIM". Neither are programs that I have installed and certainly not installed on my NAS. As of this post right now, I havent seen it reappear but Ill update if I do. I thought I would just mention that to see if it helps diagnose the problem of this hack.

Of course there's no easy way to tell what the hack was doing. But given the amount of traffic, you should assume the your files were being uploaded, and take whatever precautions are needed for identity theft. I'd back up the NAS, zero the disks, and do a clean install (upgrading to 4.2.27 T5). Then restore the data from backup. It isn't clear that an OS reinstall is enough (though it might be).

If that simply isn't practical, you should still back up the NAS before you attempt the OS reinstall, since the reinstall might not be able to fully resolve the hack (and it is conceivable that you might end up bricked as a result).

On the services - not sure why the router is blocking services by default (my R6300v2 is not), but programs don't generally get exclusive rights to internet ports. A few older and very common programs (web browsers, ftp, email) are allocated their own ports by the internet authority people. But not "age of empires" and probably not AIM - they use ports, but don't "own" them. That long list of services was reverse engineered by Netgear, and is mostly a convenience.

So internet ports are often used for multiple services, and there might be other reasons to block those ports that are not apparent in the service name. In any event, blocking ports that aren't supposed to be used is a conservative choice - the catch is that it is often difficult to know what ports are used by the applications you install.

BTW, manually setting your gateway IP address to 0.0.0.0 in the NAS might also improve performance - the network being slow indicates that the NAS is attempting to communicate outbound, and it might be succeeding to some degree.

As mentioned the issue here is not your network speed. Your network is slow because the NAS is almost certainly compromised, and it is generating a flood of network traffic. The big issue is that you don't know what it is sending.

OS reinstall does not work, Hack remains active after doing this from the boot menu.

FiremedicJM wrote:
OS reinstall does not work, Hack remains active after doing this from the boot menu.

That's useful to know.

So zeroing the gateway mask to ensure the NAS never connects through the router, backing up the data, and a factory reset/data restore is the way forward. As I mentioned, I'd zero the drives before the reset, just in case a rootkit of some sort was installed.

OS Re-install doesn't wipe the OS partition. It fixes some common problems resetting some settings and overwrites some files, but as root kits can vary it can't go out and get rid of those. Though it's possible depending how they are written an OS re-install may "fix" the problem temporarily, it's likely malware will be designed to re-install itself if it gets broken meaning any fix would be short lived.

mdgm wiped my os partition for me via tech support boot and it solved the problem. No more virus! Thanks!!

StephenB wrote:
BTW, manually setting your gateway IP address to 0.0.0.0 in the NAS might also improve performance - the network being slow indicates that the NAS is attempting to communicate outbound, and it might be succeeding to some degree.

I tried setting the Default gateway for ethernet 1 to 0.0.0.0 and the NAS responds with "Invalid netmask". What are the correct settings that I need to set?

FiremedicJM wrote:
mdgm wiped my os partition for me via tech support boot and it solved the problem. No more virus! Thanks!!

Did this require a complete wipe? Also how, in my case since ive blocked all internet port traffic to my NAS, can tech support access my NAS?

Did not require a complete wipe, Just wiped the OS partition and rebuilt it so it did not wipe data. Tech support can access it if you put it into Tech mode from the boot menu. PM mdgm and I am sure he can help you.

You likely will need to unblock the internet connection on at least one port.