<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Got an email today from Synology regarding the SynoLocker thingy:<div><br></div><div><table width="618" border="0" align="center" cellpadding="0" cellspacing="0" style="line-height: 21.299999237060547px; color: rgb(68, 68, 68); font-family: Arial; font-size: 15px; background-color: rgb(255, 255, 255);"><tbody><tr><td width="618" colspan="2" align="left" valign="top" style="color: rgb(51, 51, 51); padding: 0px 18px;"><h2 style="line-height: 22.719999313354492px; font-size: 16px; margin: 0px 0px 10px;">Dear Synology users,</h2><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">We would like to inform you that a ransomware called "SynoLocker" is currently affecting some Synology NAS users. This ransomware locks down affected servers, encrypts users’ files, and demands a fee to regain access to the encrypted files.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">We have confirmed that the ransomware only affects Synology NAS servers running older versions of DiskStation Manager by exploiting a security vulnerability that was fixed and patched in December, 2013.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">Affected users may encounter the following symptoms:</p><ul style="line-height: 26px; margin-right: 0px; margin-bottom: 20px; margin-left: 1em; padding-right: 0px; padding-left: 20px; font-size: 13px;"><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">When attempting to log in to DSM, a screen appears informing users that data has been encrypted and a fee is required to unlock data.</li><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">Abnormally high CPU usage or a running process called “synosync” (which can be checked at<b>Main Menu</b> > <b>Resource Monitor</b>).</li><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">DSM 4.3-3810 or earlier; DSM 4.2-3236 or earlier; DSM 4.1-2851 or earlier; DSM 4.0-2257 or earlier is installed, but the system says no updates are available at <b>Control Panel</b> > <b>DSM Update</b>.</li></ul><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">If you have encountered the above symptoms, please shutdown the system immediately and contact our technical support here: <a href="https://myds.synology.com/support/support_form.php" target="_blank" style="line-height: 18.459999084472656px; font-weight: inherit; color: rgb(0, 135, 225); cursor: pointer;">https://myds.synology.com/support/support_form.php</a></p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">If you have not encountered the above symptoms, we strongly recommend downloading and installing DSM 5.0, or any version below:</p><ul style="line-height: 26px; margin-right: 0px; margin-bottom: 20px; margin-left: 1em; padding-right: 0px; padding-left: 20px; font-size: 13px;"><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">DSM 4.3-3827 or later</li><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">DSM 4.2-3243 or later</li><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">DSM 4.0-2259 or later</li><li style="line-height: 18.459999084472656px; margin: 0px 0px 3px;">DSM 3.x or earlier is not affected</li></ul><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">You can manually download the latest version from our <a href="http://www.synology.com/en-global/support/download" target="_blank" style="line-height: 18.459999084472656px; font-weight: inherit; color: rgb(0, 135, 225); cursor: pointer;">Download Center</a> and install it at <b style="line-height: 18.459999084472656px;">Control Panel</b> > <b style="line-height: 18.459999084472656px;">DSM Update</b> > <b style="line-height: 18.459999084472656px;">Manual DSM Update</b>.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">If you notice any strange behavior or suspect your Synology NAS server has been affected by the above issue, please contact us at <a href="mailto:security@synology.com" style="line-height: 18.459999084472656px; font-weight: inherit; color: rgb(0, 135, 225); cursor: pointer;">security@synology.com</a>.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">We sincerely apologize for any problems or inconvenience this issue has caused our users. We’ll keep you updated with the latest information as we continue to address this issue.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">Thank you for your continued patience and support.</p><p style="line-height: 26px; margin-bottom: 1.35em; font-size: 13px;">Sincerely, <br style="line-height: 18.459999084472656px;">Synology Development Team</p></td></tr><tr><td colspan="2" align="left" valign="top" style="color: rgb(51, 51, 51); padding: 0px 18px;"> </td></tr></tbody></table><br><div>> Date: Tue, 5 Aug 2014 22:27:01 -0400<br>> From: chris@chrisirwin.ca<br>> To: kwlug-disc@kwlug.org<br>> Subject: Re: [kwlug-disc] Synology, and proprietary disk formats ...<br>> <br>> On 08/05/2014 07:29 PM, Khalid Baheyeldin wrote:<br>> > The news was out about a Synology ransom ware exploit.<br>> ><br>> > http://soylentnews.org/article.pl?sid=14/08/05/1250223<br>> ><br>> > But what caught my eye is this comment about the disk formats being <br>> > proprietary and unreadable on a Linux system<br>> ><br>> > http://soylentnews.org/comments.pl?sid=3232&cid=77644<br>> ><br>> > Hostage but for another reason ...<br>> ><br>> > Posting this for those who use Synology in this group ...<br>> <br>> I've got a Synology 207+. It's a few models out of date (it's from <br>> 2007), but I've pulled the drives out and used them in my Linux boxes <br>> without issue. Was a standard ext3 filesystem, though it wasn't <br>> auto-detected like most removable drives. Manually mounting it with `-t <br>> ext3` worked correctly. Their new models might be different.<br>> <br>> A coworker has a much more capable five-bay x86 netgear box (the model <br>> escapes me), which actually runs some combination of lvm and mdadm on a <br>> stripped-down debian-ish base. It gets very confusing very fast when you <br>> start replacing disks and letting it's dynamic growth mechanism do the <br>> work (multiple raid5 slices on each disk, pooled together into a big <br>> lvm, divided into smaller shared filesystems). But again, readable on a <br>> standard Linux box (assuming you can connect at least four of five <br>> drives and can manually construct an mdadm array).<br>> <br>> <br>> -- <br>> Chris Irwin<br>> e: <chris@chrisirwin.ca><br>> w: http://chrisirwin.ca<br>> <br>> <br>> <br>> _______________________________________________<br>> kwlug-disc mailing list<br>> kwlug-disc@kwlug.org<br>> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org<br></div></div> </div></body>
</html>