Giacomo Lanzi

Ransomware and NAS: a risk that is not considered

Estimated reading time: 6 minutes

Despite some seasonal declines, ransomware is still a serious security threat, especially for those who underestimate it . It is often thought that to protect yourself from ransomware it is enough to have a backup copy of your data. This point of view does not take into consideration various aspects. One of them is the relationship between ransomware and NAS ( Network Access Storage ), where you often store a backup copy of the server, thinking it is enough.

Ransomware attacks are capable of rendering entire disks unusable by encrypting the file system . Network disks are at risk, which can also be encrypted, reducing the effectiveness of a backup stored on a NAS.

Ransomware and Nas: Attack

Definition of Ransomware

Ransomware, as we have seen in other articles, is a form of malware that encrypts the victim’s files. The attacker then demands a ransom from the victim to restore access to data against payment .

Users are shown instructions on how to pay a fee to obtain the decryption key. Costs can range from a few hundred euros to thousands, payable to cybercriminals in Bitcoin.

Once the malware gets executed, it’s almost always too late. In fact, often the victim does not notice until the ransom demand is made or when the entire disk has been completely encrypted.

How ransomware works

There are several ways that ransomware can take to access a server. One of the most common delivery systems is phishing . Some attachments arrive at the victim’s computer in an e-mail message, masked from a harmless file.

Once executed, these software masquerading as harmless files can take control of the victim’s computer, especially if they have social engineering tools built in which trick users into allowing administrative access . Tracing back to the server isn’t as complicated as it might seem.

Some other more aggressive forms of ransomware, such as NotPetya , exploit security holes to infect computers without the need to trick users.

There are several things malware could do once it has taken over the victim’s computer, but by far the most common action is to encrypt some or all of the files it has access to. If you want to get into the technical, here’s more information on how encryption takes place.

The most important thing to know is that at the end of the process, files cannot be decrypted without a mathematical key known only to the attacker . The victim is presented with a ransom note and explained that without a payment, the files will remain inaccessible.

Regardless of the requests and how the ransomware is unleashed in the first place, the thing to note is that there is no data that can be saved. So, if your customers’ data is on a server, they can be involved in such an attack.

If the ransomware encrypts file systems and not just individual files, the problems could multiply.

Ransomware and Nas

Ransomware, NAS and backups

One of the ways to mitigate the risk is to have a backup available with which to restore the data without having to surrender to payment. The best practices for management backups do not want there to be backups on the same machine, so it is possible that they are kept on network disks, always accessible from servers. But in fact those disks are part of the machine, as they are accessible.

These disks, called NAS (Network Access Storage), are great solutions for managing files on a network, but they can become as useless as the server in the event of a ransomware attack. If the attack encrypts the file systems, it is possible that finding the remote folders on the NAS encrypts those as well, rendering the backup unusable.

The targets of a ransomware

There are several ways attackers choose which organizations they target with ransomware attacks. Sometimes it’s a matter of opportunity – for example, attackers might target universities because they tend to have smaller security teams and a disparate user base that share many files, making it easier to penetrate their defenses.

On the other hand, some organizations are tempting targets because they seem more likely to pay a ransom quickly. For example, government agencies or medical facilities often need immediate access to their files. .

Law firms and other organizations with sensitive data may be willing to pay to keep news of a compromise hidden , and these organizations are often particularly sensitive to a data exfiltration threat.

However, it has been noted that some ransomware is capable of spreading itself on the network . In fact, no one is completely safe, especially if the data stored on the servers is sensitive.

Ransomware and Nas: Laptops and NAS

Ransomware and NAS: how to manage backups

As we have seen, ransomware is no small threat to the data stored on corporate servers. Now let’s see what precautions you can take to protect your data and servers.

Do not use NAS for backups

Se il ransomware arriva a un NAS, quasi certamente lo cifrerà rendendo il backup inaccessibile. Evitare questo problema è facile: usare il cloud!

The server provider should offer the ability to store machine backups on the cloud . This means that the backups are not always reachable by the server and therefore the software is unable to encrypt them.

This is the standard of our VPS service . In case of compromise, in fact, it is sufficient to restore the virtual machine to an earlier state through one of the backups stored in the cloud .

Alternatively, you can backup on premise , ie locally, physically in the company. Using the Acronis Backup service you can perform a backup on an external disk not connected to the network.

Another solution, hybrid of the previous ones, is to create a backup through Acronis and store it in the cloud and not locally. You maintain the advantage of having a remote backup that is not connected to the server constantly.

Preventing attacks

Finally, it is correct to mention that there is another solution, the precautionary solution. With the use of our service SOC and thanks to the use of latest generation analysis systems, it is possible to immediately identify a malware or an attack ransowmare and block it before it does damage.

Whether it is adopting best practices for backup and storing them remotely, or adopting a SOC to protect this aspect and many others in the field of IT security , SOD is available to discuss the situation and find a solution tailored to the needs of your company.

Contact us to ask for information, we will be happy to answer any questions.

Link utili:

Useful links:

Alternative to the NAS

Share


RSS

More Articles…

Categories …

Tags

RSS Dark Reading

RSS Full Disclosure

  • Defense in depth -- the Microsoft way (part 83): instead to fix even their most stupid mistaskes, they spill barrels of snakeoil to cover them (or just leave them as-is) March 17, 2023
    Posted by Stefan Kanthak on Mar 16Hi @ll, with Windows 2000, Microsoft virtualised the [HKEY_CLASSES_ROOT] registry branch: what was just an alias for [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] before became the overlay of [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] and [HKEY_CURRENT_USER\Software\Classes] with the latter having precedence: Note: while [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] is writable only by...
  • [CFP] Security BSides Ljubljana 0x7E7 | June 16, 2023 March 17, 2023
    Posted by Andraz Sraka on Mar 16MMMMMMMMMMMMMMMMNmddmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM MMN..-..--+MMNy:...-.-/yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM MMy..ymd-.:Mm::-:osyo-..-mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM MM:..---.:dM/..+NNyyMN/..:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM Mm../dds.-oy.-.dMh--mMds++MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM My:::::/ydMmo..-hMMMmo//omMs/+Mm+++++shNMN+//+//+oMNy+///ohM MMMs//yMNo+hMh---m:-:hy+sMN..+Mo..os+.-:Ny--ossssdN-.:yyo+mM...
  • Full Disclosure - Fastly March 12, 2023
    Posted by Andrey Stoykov on Mar 11Correspondence from Fastly declined to comment regarding new discovered vulnerabilities within their website. Poor practices regarding password changes. 1. Reset user password 2. Access link sent 3. Temporary password sent plaintext // HTTP POST request POST /user/mwebsec%40gmail.com/password/request_reset HTTP/2 Host: api.fastly.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 […]
  • Full Disclosure - Shopify Application March 12, 2023
    Posted by Andrey Stoykov on Mar 11Correspondence from Shopify declined to comment regarding new discovered vulnerabilities within their website. Although 'frontend' vulnerabilities are considered out of scope, person/tester foundhimself a beefy bugbounty from the same page that has been listed below, including similar functionality that has not been tested yet. Two emails and several reports, […]
  • [CVE-2023-25355/25356] No fix available - vulnerabilities in CoreDial sipXcom sipXopenfire March 7, 2023
    Posted by Systems Research Group via Fulldisclosure on Mar 06
  • SEC Consult SA-20230306-0 :: Multiple Vulnerabilities in Arris DG3450 Cable Gateway March 7, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Mar 06SEC Consult Vulnerability Lab Security Advisory < 20230306-0 > ======================================================================= title: Multiple Vulnerabilities product: Arris DG3450 Cable Gateway vulnerable version: AR01.02.056.18_041520_711.NCS.10 fixed version: - CVE number: CVE-2023-27571, CVE-2023-27572 impact: medium homepage: https://www.commscope.com...
  • OpenBSD overflow March 7, 2023
    Posted by Erg Noor on Mar 06Hi, Fun OpenBSD bug. ip_dooptions() will allow IPOPT_SSRR with optlen = 2. save_rte() will set isr_nhops to very large value, which will cause overflow in next ip_srcroute() call. More info is here https://github.com/fuzzingrf/openbsd_tcpip_overflow/ -erg
  • SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN March 3, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Mar 02SEC Consult Vulnerability Lab Security Advisory < 20230228-0 > ======================================================================= title: OS Command Injection product: Barracuda CloudGen WAN vulnerable version: < v8.* hotfix 1089 fixed version: v8.* with hotfix webui-sdwan-1089-8.3.1-174141891 or above version 9.0.0 or above CVE number: CVE-2023-26213...
  • SRP on Windows 11 March 3, 2023
    Posted by Andy Ful on Mar 02The correction to: Full Disclosure: Defense in depth -- the Microsoft way (part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2 (seclists.org) The Kanthak correction to restore SRP functionality on Windows 11 ver. 22H2, works only when Smart App Control is OFF. If it is in Evaluate […]
  • NetBSD overflow March 3, 2023
    Posted by Erg Noor on Mar 02Hi, Trivial overflow in hfslib_reada_node_offset, while loop has no range checks. |size_t hfslib_reada_node_offsets(void* in_bytes, uint16_t* out_offset_array) { void* ptr; if (in_bytes == NULL || out_offset_array == NULL) return 0; ptr = in_bytes; out_offset_array--; do { out_offset_array++; *out_offset_array = be16tohp(&ptr); } while (*out_offset_array != (uint16_t)14); return ((uint8_t*)ptr - (uint8_t*)in_bytes); }| […]

Customers

Newsletter