ReadyNas RN2100 hacked

Question

So it appears that my credentials were exposed after a recent data breach from Netgear (thanks guys) and I received an email a few months back saying all my data and been stolen and I wanted to get it back is to pay crypto. Luckily for me, I only saved irrelevant files such as movies and TV shows, so I am not really interested in getting it back.

However what I want to know is, how can I secure my device to ensure the cloud account is no longer linked to my device and what is the best way to use this device moving forward? I never got any email correspondence regarding the end of life of ReadyNAS which is dissapointing but I am not finger pointing or angry, just wanting to resolve this so I can resume my movie server.

Any help is appreciated! Thank you

StephenB · Answer

apopcontest&nbsp;wrote:
So it appears that my credentials were exposed after a recent data breach from Netgear (thanks guys)

I'm puzzled here.&nbsp; Can you confirm that the NAS is an RN2100 running 4.1.x firmware?&nbsp; Did you get an email from Netgear telling you there was a breach?&nbsp; Or are you just speculating?
&nbsp;
The Netgear cloud services that can reach your NAS over the internet (photos and readyremote) were taken down long ago.&nbsp; There is no Netgear cloud account or server that is linked to your NAS.&nbsp;
&nbsp;
How were the hackers able to reach your NAS?&nbsp;Were you forwarding ports to it?&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;

StephenB · Answer

Thx for the screenshots.&nbsp; My replies so far assumed you had an RN2100 (as you said in your title).&nbsp; But you actually have an RN214, which is a completely different (and much newer) ReadyNAS platform.&nbsp;
&nbsp;
RN2100:

&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
RN214:

&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
&nbsp;
The RN214 could have been connected with ReadyCloud, as it is an OS-6 platform.&nbsp; That would have stopped last summer when Netgear took down the service.&nbsp;

Do you recall when you received that email?
Also, was your NAS originally named "Crypto", and did it have a share called "coin"? (I'm assuming not!)

&nbsp;
apopcontest&nbsp;wrote:
&nbsp;
Not unless you had forwarded ports to the NAS to enable remote connections.&nbsp; Or alternatively if they compromised a PC you use to connect to the internet.
&nbsp;
Is there a way to find this?
&nbsp;

As far as port forwarding goes, you'd look for that in your router settings.&nbsp; Any port forwarding rules should be remted. While there,

you should check to see if the uPNP service is enabled.&nbsp; If it is, then you should turn that off.&nbsp; It is a security risk, as it does allow any device on your home network to open up ports in your router's firewall.
make sure the router firmware is up to date.
If remote administration is enabled on your router, then I suggest disabling that.
Also change the router's admin password.

&nbsp;
What router model (and manufacturer) are you using?
&nbsp;
You might also want to run malware scans on all your PCs.&nbsp; For instance, using the free download of malwarebytes.

https://www.malwarebytes.com/

Given the overall situation, it might be worth getting a subscription for a while, so you'd have real-time protection on your PCs.
&nbsp;
Also, if you are using Microsoft accounts on your PCs (connected with Microsoft OneDrive), then you should also change the Microsoft passwords.
&nbsp;
&nbsp;
apopcontest&nbsp;wrote:
&nbsp;
How do you suggest I proceed moving forward to secure the device?&nbsp;

It's not just securing your NAS.&nbsp; You need to make sure your home network (and all devices on it) are secured.&nbsp;&nbsp;
&nbsp;
In general, the NAS settings are all on the disks.&nbsp; So a factory default should bring the NAS back to its out-of-the-box state.&nbsp; So you'd need to set up the NAS from scratch. The ReadyNAS service (like all cloud services) would be disabled&nbsp; Since the service is down, you would not be able to join ReadyCloud (and shouldn't attempt it).&nbsp; Obviously set up different credentials.
&nbsp;
After the initial factory default, you should update the firmware to 6.10.9 (which needs to be done manually)

https://kb.netgear.com/000065653/ReadyNAS-OS-Software-Version-6-10-9

&nbsp;
Reinstalling plex is possible, but due to the deprecation of Debian 8 (the linux OS your NAS uses) earlier this year, you'd need to make some changes.&nbsp; This (rather long) discussion thread includes the info on what is needed.

https://community.netgear.com/t5/Using-your-ReadyNAS-in-Business/How-I-got-apt-update-and-install-to-work-with-Debian-Jessie/m-p/2309160

Post 37 has the files you need to modify/add.&nbsp; Post 1 tells you where you need to put them.
&nbsp;
Personally I run Plex on an always-on Windows PC, which has the media share(s) mapped to drive letters.
&nbsp;
Risks here:

Since you don't really know how the NAS was compromised, the same security vulnerability might remain (and might not be on your NAS at all).
There is a very small chance that the hacker might have installed a root kit on the disks (which can be very difficult to remove).

On (2) you could just install new disks, and get rid of the old ones.
&nbsp;
&nbsp;

apopcontest · Answer

Hello,&nbsp;Currently away from where my NAS is located for a few days, I can confirm that my NAS is&nbsp;RN2100 running 4.1.x firmware and I do recall reading an email from Netgear informing me of a data breach, however I have had a few to be honest and I never really paid attention to them too much.&nbsp;I was under the impression that ReadyNAS Cloud was only closed late last year (which I was unaware of) and I have ReadyCloud Client installed on my computer which I cannot access which I understand.&nbsp;&nbsp;I am not sure how the hackers were able to access my NAS, I can access it using what I created at the time for my username and password which was email and an old password which I never changed, I believe this password is probably available somewhere online for people to make attempts to login using my credentials,Would this be how they were able to access my NAS?&nbsp;&nbsp;Any recommendations on how to move forward? Do a hard reset? My concern would be that if I placed data on my NAS, a hacker would be able to access my NAS using my old credentials.

StephenB · Answer

apopcontest&nbsp;wrote:
&nbsp;
I was under the impression that ReadyNAS Cloud was only closed late last year (which I was unaware of) and I have ReadyCloud Client installed on my computer which I cannot access which I understand.&nbsp;
&nbsp;

Netgear branding has often re-used old names, which unfortunately creates a lot of confusion. The ReadyCloud you had installed was shut down in September 2016, so your NAS hasn't been connected to it for 7 years.
&nbsp;
The service that was shut down in July was only for ReadyNAS running 6.x firmware.&nbsp; So not compatible with your NAS.
&nbsp;
apopcontest&nbsp;wrote:
&nbsp;
I am not sure how the hackers were able to access my NAS, I can access it using what I created at the time for my username and password which was email and an old password which I never changed

Let's start from the beginning.&nbsp; FWIW, I don't think your NAS ever supported email format usernames, so that part of your email is a bit confusing.
&nbsp;
What apps did you have installed on your NAS?&nbsp; Bittorrent perhaps?
&nbsp;
Did you ever forward any ports in your router to the NAS?
&nbsp;
You received an email from someone claiming to have encrypted your files.&nbsp; Did they specifically say they had hacked your ReadyNAS?&nbsp; Or just that they had encrypted files?&nbsp; Did you click on any links or open any attachments in that email?&nbsp; It's possible that the email was fake.
&nbsp;
You are away from home, and cannot access your NAS.&nbsp; Have you tried accessing it while you were home?&nbsp; When did you lose access?&nbsp;&nbsp;
&nbsp;
If you have access, are you able to see your shares?&nbsp; If so, what files are you seeing in the shares?&nbsp;&nbsp;
&nbsp;
When you try to access frontview now (when home) are you getting an SSL version or Cipher Mismatch error?&nbsp; Or are you getting something else.
&nbsp;
&nbsp;
apopcontest&nbsp;wrote:
I believe this password is probably available somewhere online for people to make attempts to login using my credentials,Would this be how they were able to access my NAS?&nbsp;
&nbsp;

Not unless you had forwarded ports to the NAS to enable remote connections.&nbsp; Or alternatively if they compromised a PC you use to connect to the internet.
&nbsp;
apopcontest&nbsp;wrote:
&nbsp;
Any recommendations on how to move forward? Do a hard reset? My concern would be that if I placed data on my NAS, a hacker would be able to access my NAS using my old credentials.

FWIW, I am not (yet) seeing strong evidence that the NAS was in fact hacked.&nbsp; There were changes in Chrome, Edge, Firefox, and Safari last year that do prevent access to Frontview.&nbsp; There are some workarounds, but AFAICT you don't know about them.&nbsp;
&nbsp;
It is also possible that disk failures (or a NAS failure) is the actual cause of your problem.&nbsp; So there are other explanations to lack of access that haven't really been ruled out.
&nbsp;
Do you only have an access problem reaching your files?&nbsp; Or do you actually see encrypted files on the NAS when you access it.
&nbsp;
As far as old credentials go, if you do a factory default then those credentials will no longer work with the NAS.&nbsp; But of course if you also use them for other devices (or accounts) you should start by changing them.
&nbsp;
Plus access to your NAS over the internet requires more than the old credentials.&nbsp; Normally your router won't allow a hacker to reach the NAS.&nbsp; So we'd also need to understand how the alleged hacker managed to get through your router.
&nbsp;

apopcontest · Answer

Sorry I don't know how to quote, so I will try and answer accordingly...&nbsp;What apps did you have installed on your NAS?&nbsp; Bittorrent perhaps?&nbsp;Did you ever forward any ports in your router to the NAS?&nbsp;Not Bittorrent, I only had Plex Server installed on NAS, could they have gained access with a compromised username and password on Plex?&nbsp;You received an email from someone claiming to have encrypted your files.&nbsp; Did they specifically say they had hacked your ReadyNAS?&nbsp; Or just that they had encrypted files?&nbsp; Did you click on any links or open any attachments in that email?&nbsp; It's possible that the email was fake.&nbsp;Please see this screenshot, the same message was saved on my NAS which was emailed, which I initially ignored as I was busy at the time. I have blocked out other information for the safety of others.&nbsp;Not unless you had forwarded ports to the NAS to enable remote connections.&nbsp; Or alternatively if they compromised a PC you use to connect to the internet.&nbsp;Is there a way to find this?&nbsp;Here are some other screenshots for further assistance.&nbsp;&nbsp;Moving forward, should I remove the Plex App? Hard to tell if my computer was compromised I do have paid antivirus protection on my laptop. I have been exposed to a few data breaches already but nothing too major (so far), I thought perhaps my older credentials have been sitting somewhere on the internet and someone had a crack at accessing my NAS through ReadyCloud. The only way I can access the NAS currently is by clicking on the explorer button and selecting 'Network' then when accessing the drive, I am asked to login, which I used my ReadyCloud email address and password, this is what gives me the understanding that a hacker was able to access my files using these credentials.&nbsp;How do you suggest I proceed moving forward to secure the device?&nbsp;

Forum Discussion

ReadyNas RN2100 hacked

9 Replies

Related Content

RBS20 Hack

RBR / RBD40 - Jan 2025 Firmware Update Notification - Is it a hack?

Hacked and locked out

WC7500 SSL Certificate is hacked!

ReadyNas 212 HELP needed

NETGEAR Academy

ProSupport for Business