Javascript required
Skip to content Skip to sidebar Skip to footer
Home / Do You Have to Download the Software for Ts3122 Updated FREE

Do You Have to Download the Software for Ts3122 Updated FREE

Do You Have to Download the Software for Ts3122

If you lot ain an Asustor NAS and are reading this – Bank check It NOW

Original Article – As of around one hr ago, multiple users online are reporting that their Asustor NAS systems have been attacked by ransomware known as Deadbolt. Much similar the ransomware attack of QNAP NAS systems of the same proper name, this is a remote-command-pu#sh encryption set on that takes advantage of a vulnerability in the system software to command the system to encrypt the data on the NAS organisation, but with the added twist in this recent update of adding a new login GUI style space screen request for 0.03BTC.

Updated 24/02 09:45 GMT

Asustor has merely released a firmware update for their ADM 4 systems ( Hither ) for users who have not been hitting past the Deadbolt ransomware assail, who are keeping their systems offline and/or powered down until the security issue/vulnerability was identified and neutralized. Hither are the Asustor details on this:

An emergency update to ADM is provided in response to Deadbolt ransomware affecting ASUSTOR devices. ASUSTOR urges all users to install the latest version of ADM as presently as possible to protect themselves and minimize the risk of a Deadbolt infection. ASUSTOR too recommends taking measures to guard against the potential harms of Deadbolt in accordance with the previously announced protective measures. Please review the measures below to help increment the security of your data on your ASUSTOR NAS.

  • Change your password.
  • Use a strong password.
  • Change default HTTP and HTTPS ports. Default ports are 8000 and 8001 respectively.
  • Change spider web server ports. Default ports are eighty and 443.
  • Plough off Terminal/SSH and SFTP services and other services you do not utilise.
  • Brand regular backups and ensure backups are up to engagement.

In response to increasing numbers of ransomware attacks, ASUSTOR has committed to an internal review of visitor policies to regain customer trust. This includes, but is not limited to increased monitoring of potential security risks and strengthening software and network defenses. ASUSTOR takes security very seriously and apologizes for any inconvenience acquired.

Updated 23/02 21:03 GMT

Much like the deadbolt assail on QNAP devices before in 2022, in the inverse alphabetize GUI on affected NAS', the deadbolt team are offering to provide data to ASUSTOR about the zero-day vulnerability used to alienation NAS devices and the primary decryption for all affected users to get their data back. The DeadBolt link includes a link titled "of import message for ASUSTOR," which displays a message from DeadBolt for the attention of ASUSTOR. DeadBolt orchestrators are offer to details of the vulnerability if ASUSTOR pays them 7.5 BTC, worth $290,000. DeadBolt is also offering ASUSTOR the master decryption central for all victims and the zero-day breakdown explained for 50 BTC, worth $ane.9 million. The ransomware operation states that there is no mode to contact them other than making the bitcoin payment. Nevertheless, once payment is fabricated, they say they will send the information to the security@asustor.com email address.

Updated 06:50 GMT

Asustor has issued the post-obit statement and recommendation for those who are (or believe they have been affected past the Deadbolt ransomware):

In response to Deadbolt ransomware attacks affecting ASUSTOR devices, ASUSTOR EZ-Connect, ASUSTOR EZ Sync, and ezconnect.to will be disabled as the consequence is investigated. For your protection, we recommend the following measures:

Alter default ports, including the default NAS web access ports of 8000 and 8001 besides equally remote web access ports of 80 and 443.
Disable EZ Connect.
Make an immediate backup.
Plough off Final/SSH and SFTP services.

For more detailed security measures, please refer to the post-obit link below:
https://www.asustor.com/en-gb/online/College_topic?topic=353

If yous discover that your NAS has been affected by Deadbolt ransomware, please follow the steps listed below.
1. Unplug the Ethernet network cable
2. Safely close downwardly your NAS by pressing and belongings the power push button for three seconds.
3. Do not initialize your NAS as this will erase your data.
4. Fill out the form listed beneath. Our technicians will contact you as shortly as possible.

https://docs.google.com/forms/d/due east/1FAIpQLScOwZCEitHGhiAeqNAbCPysxZS43bHOqGUK-bGX_mTfW_lG3A/viewform

Regarding filling out the technical support form, this is likely to assistance the make identify the scale of the issue, but likewise permit a faster sharing (to those affected) of any recovery tools that might exist possible. However, the culprit is looking increasingly like the EZ Connect Asustor Remote service. This has been further backed upwardly by the fact that the official Asustor ADM demo folio has likewise been hit by the Deadbolt ransomware (now taken offline). Additionally, many users who powered down their device during the deadbolt assail, upon rebooting their NAS organisation have been greeted with the message in the Asustor Control Heart awarding that their system needs to be 're-initialized'. The most likely reason for this is that during the encryption processes, the cadre arrangement files are the first files that become targeted and if the system was powered downwardly/powered off immediately during this process, it may have corrupted system files. We are currently investigating if a recovery via mounting a drive in a Linux car is possible (in conjunction with roll-back software such as PhotoRec).

If your Asustor NAS is in the process of existence hit (even if you lot just doubtable it) every bit your HDDs are buzzing abroad unusually (and the HDD LEDs are flickering at an unusual hour), then information technology is recommended that you caput into the procedure manager and run into if the encryption process has been actioned by Deadbolt. The following proposition of activity was suggested by NAScompares commenter 'Clinton Hall' :

My solution so far, login vis ssh as root user

cd /volume0/usr/builtin
ls

y'all will run into a 5 digit binary executable file For me information technology was 22491. I use that in the following command to become the process ID

ps | grep 22491

from this I got the Process id 25624. I kill that process

kill 25624

I and so remove the binary file

chattr -i 22491
rm -f 22491

At present, restore the alphabetize as higher up

cd /usr/webman/portal
chattr -i index.cgi
rm alphabetize.cgi
cp index.cgi.bak alphabetize.cgi

Now for the fun part…. a LOT of file had been renamed (not encrypted) to have .deadbolt appended to the end of the filename… And then rename them back

(note, y'all may want to practice this folder by folder and check it is working). The following will do for the entire /volume1

cd /volume1
detect . -type f -proper noun "*.deadbolt" -exec bash -c 'for f; practise base=${f##*/}; mv -- "$f" "${f%/*}/${base//.deadbolt/}"; done' _ {} +

Later these are all renamed, everything should piece of work. Probably a good thought to reboot to restart the services etc.

Also, I'g not certain if the higher up will definitely traverse the .@plugins etc… and then I did this manually

cd /volume1/.@plugins
find . -blazon f -name "*.deadbolt" -exec bash -c 'for f; do base=${f##*/}; mv -- "$f" "${f%/*}/${base//.deadbolt/}"; washed' _ {} +

If you accept not been hit, I would recommend yous action the following from inside your Asustor NAS (or better yet, where possible) ability the device down until an official statement and a possible firmware patch is issued.

  • Disable EZ Connect
  • Plow off automatic updates
  • Disable SSH (if you do not demand information technology for other services)
  • Block all NAS ports of the router, and simply let connections from inside the network

Updated 19:30 GMT

More details are coming up and it looks like (at to the lowest degree looking at the messages on the official Asustor  Forum and Reddit) the vulnerability stems from a vulnerability in EZConnect that has been exploited (still TBC). User billsargent on the official Asustor forums has posted some useful insights into how to become around the login screen and as well details on the processes:

Take your NAS OFF of ezconnect. Block its traffic incoming from exterior.
This overwrites the index.cgi with their own. In /usr/webman/portal in that location is a backup re-create of your index there.
To remove theirs, y'all need to chattr -i index.cgi and replace it with the fill-in.
But you'll also take to kill the process. Mine had a process that was just numbers running. I killed it, then deleted it. In /tmp there was another binary that was just numbers.
This is probably non possible to fix without a reset only you can get back into your portal with the to a higher place info. Right at present though mine is still immediately replacing the index.cgi.

And:

I am bold yous take ssh capabilities? If and so you only need to ssh in and login as root and run these commands. This should help you lot become back into the portal.

cd /usr/webman/portal
chattr -i index.cgi
rm index.cgi
cp index.cgi.bak index.cgi

If you look at the alphabetize.cgi they created before you lot delete it, its a text script.
I am still in the investigative stages but zip in my shares have been locked up with this yet. Just things in /root so far.
I've pulled out a ton of LTO tapes to backup my data. I think this is going to crave a total reset. I promise asustor releases a fix for this but I volition never again allow my NAS to have outside admission again.

For description. This is what my /usr/webman/portal directories looked similar. the .bak file is the original index.cgi.
I apologize if my posts seem jumbled up a fleck. I'1000 trying to assistance and also figure this out likewise. So I'chiliad relaying things as I find them in hopes that others volition be able to at least become back to their work.

Thanks to Asustor user billsargent for the to a higher place and full credit to him on this of class.

(Continuing with the Original Article from 21/02 17:30 GMT)

Although it is still very early in the actioning of this encryption assault, these attacks are slowly starting to emerge on forums right now, as well as twitter, run across below:

Additionally, this splash bulletin contains a phone call-out to Asustor themselves (much similar the QNAP NAS deadbolt assault) that states a message and a link for the brand to open a discussion (i.e pay) towards a master primal and details of the vulnerability they have exploited:

"All your affected customers take been targeted using a zero-day vulnerability in your product. We offer you two options to mitigate this (and future) damage:"

Details are however emerging, so I will continue this article short and sugariness for now (and add together more later as details emerge), if y'all own an Asustor NAS drive, bank check it immediately! Regardless of whether you have enabled remote access via EZConnect or not (equally that is non necessarily the key to the attack vector and possible remote DLNA port changes by your system, for example), check it at present and ideally disconnect information technology from the internet. Currently, at that place is non enough data to define if this relates to a case of 'out of date firmware' having an existing vulnerability or something inherent in the current firmware. Regardless, check your system and where possible, disconnect it from the internet until farther details are confirmed hither, on reputable sites such as Bleeping Computer or via direction from Asustor themselves.

Once y'all log into your NAS, bank check your logs and check your processes. If you have the means to backup to a NEW location, do so. DO Not overwrite your existing backups with this backup unless y'all are 100% certain yous take not been hitting past deadbolt ransomware.

What to Do if you take been hit by the Deadbolt Ransomware

If you have been hit past the vulnerability, you volition likely be unable to connect remotely with your NAS files/folders. Even if you can, yous need to bank check whether you can open up them or they have been encrypted to a new format (the extension/ .type or file will take inverse). The following users commented onreddit and in that location are similar threads that we can come across on their setup and how they got hitting.

IF you still have admission to your files, get your backups in guild!!!!!

Otherwise, if you lot have been striking by this, and then you lot need to disconnect your system from the internet. Killing any processes in the chore manager is an selection Even so practise bear in listen that doing then might corrupt currently encrypting files and therefore stop any kind of recovery. I am checking with a couple of affected users (as well as reaching out to Asustor equally we speak to see if a suitable course of action can be recommended. Some users who have restarted their system or immediately pulled the power and rebooted have found that their system now states that information technology needs to be reinitialized.

One big factor to keep in mind right now is that not is still unclear if a) the deadbolt ransomware can be killed as a organization process in the Asustor control middle (I practice not have an Asustor NAS that is afflicted in my possession right now) and b) if switching your system off DURING the deadbolt attack tin lead to the data existence unsalvagable equally the encryption is partway through. And then, disconnect from the internet (physically and via EZConnect for now) and if you lot tin can see youR CPU usage spiking and/or your HDD LEDs going basics, you are likely existence hitting.

My Asustor NAS is Maxim it is Uninitialized

Practise Non RE-INITIALIZE YOUR NAS. At least not yet, if you have already powered your NAS as a reaction to the attack (understandable, if not the best pick without knowing the full attack vectors or how this affects the encryption) and you are being greeted by the option to reinitialize in the Asusto Command Center application, then power the device downward again. Simply again, I merely recommend this action right at present for those that already reacted to the attack by shutting down their arrangement/restarting already post-attack

If I am not hit by Deadbolt, Should I disconnect my Asustor NAS from the internet?

For at present, Yeah. As the act vectors are non clear and in that location are reports from some users right now that country that they had the latest firmware, they were still hitting, there is so much unconfirmed info here to permit remote admission (in my opinion) and until farther info is fabricated available, I strongly recommend disconnecting your Asustor NAS from the cyberspace (wire AND via the software settings) and getting your backups in order.

I will update this commodity soon as more information becomes available.

Do You Have to Download the Software for Ts3122

DOWNLOAD HERE

Source: https://nascompares.com/2022/02/21/asustor-nas-drives-getting-hit-by-deadbolt-ransomware/

Posted by: carterastive.blogspot.com