Source
r/qnap•
Vortax_Wyvern

PSA: I'm having a meeting with QNAP staff about QSnatch. Leave your questions here.

Hi everyone.

u/QNAPDaniel kindly contacted me to arrange a meeting with QNAP staff next week, because they are now ready to disclose some extra information about QSnatch, probably including infection vectors.

We will talk about it, and I will be allowed to ask some questions about this matter, and this is why I'm making this post.

If any member of this community has some questions about QSnatch that would like to get answered, please leave them below, and I'd try to make them reach QNAP.

I cannot warrantee that I will be allowed to ask all of them, or that all them will be answered, but I'll do my best.

Posted Mar 3, 2020, 7:59 PM UTC · edited

2722
projxit2xTS-873 + DS415+•

u/Vortax_Wyvern when is the meeting?

Here are my questions:

  • By hiding the attack vector, does QNAP recognise the reputational damage this caused?
  • Was the attack-vector disclosed to any 3rd party security researchers, so they can try to identify similar means of attack?
  • Many consumer-users see documentation explaining usage of port-forwarding(and other insecure practises that expose a NAS) and see this a green-light from QNAP, as "surely a vendor would not recommend this if it was insecure". Will QNAP add health warnings to these pages?
  • A lot of QNAP owners are reluctant to use myQNAPCloud, because it exposes too much. Can QNAP add more granular controls on the NAS side, i.e. so only certain services such as Push notifications, apps and specific fileshares can be made available? (Putting the control into the users-hands, rather than all or nothing)
  • Will QNAP be willing to put emphasis on security such as
    • a decent Firewall. Something local, even a GUI wrapping IPTables. This would allow Admins can restrict access to not only "QNAP" apps, but also the 3rd-party apps running on different ports (and Docker containers etc) - And NO the coming SD-WAN VM does not constitute this (Its a performance bottleneck and will not work at line-speed)
    • A reverse proxy, with some form of SSO.
7
Vortax_WyvernOPTS-673 + DS218J•

The meeting is happening next Monday.

Your questions sure are very interesting, by the way.

2
projxit2xTS-873 + DS415+•

Thanks. It really winds me up seeing vendors shrug off responsibility, or refusing to make even the smallest of enhancement that could have huge benefits.

I'll admit, I've not had sudden inspiration. I've opened several related fix and feature requests:

  1. Add a local Firewall, for restricting and locking down services/apps - Initially support told me the SD-WAN app would fit this role, but its a VM, so no, it won't. I've since pushed back, and explained that its a bottleneck, this needs a local stateful firewall to provide security for LAN (at line-speed i.e. 1Gb or 10Gb).
  2. Add GEO-IP blocking / allow... This would go a huge way to helping secure NAS's that owners have made publicly accessible. Being in the UK, I can just allow access to know UK IP sources - effectively blocking attacks from anywhere else in the world.

Really there is no excuse not to add this, the GEO-IP lite DB is free, the only cost to QNAP is time of the developers to implement it.

  1. Fix features that require mandatory use of Admin user, and don't support MFA. Such snapshot replication (This requires MFA to be disabled)
6
opensourcefan•

I would like to see QNAP be proactive about security vs reactive. They make a good product, if some of that skill was placed into proactive security I would feel more confident in their product.

4
projxit2xTS-873 + DS415+•

QNAP product managers seem to have the attention span on a gold-fish, rather than fixing and enhancing - They're focusing on the next shiny project, which is detrimental.

1
Billsplacenta•

Couldn't they have found a better name?

3
soulmagic123•

I think they decided to call it Qsnatch because Qc*nt was taken.

11
projxit2xTS-873 + DS415+•

I've always had a soft spot for Cludge... so Qludge maybe?

https://www.urbandictionary.com/define.php?term=Cludge

1
Real_abelincolnjr•

When do they foresee when they’re going to have a solution to fix the issue, either cloud based or a download? I have the antivirus/malware suite and it seems fairly useless in this case.

3
QNAPDaniel QNAP OFFICIAL SUPPORT•

Right now, in the cases where our malware app is not able to completely remove the virus, our tech support can help.

The vulnerabilities that allowed people to get the virus for the first time have been patched. So if you have never had the Qsnatch virus, and you have up to date firmware you should not get it.

People who seem to have gotten reinfected with up to date firmware are cases where the virus was not 100% removed so they are not actually reinfections but they are really dealing with the original infection. Those cases are more rare but if you are one of those cases our tech support can help you 100% get rid of Qsnatch. And then it should not come back.

3
cojerkTS-451•

Was I at risk if my Qnap was behind my router's NAT and had no port forwards setup?

Edit: what's the best, most definitive way to know if you're not infected?

2
Vortax_WyvernOPTS-673 + DS218J•

To know if you are infected, follow the check advices located in the sticky QSnatch post

1
terisk•

What was the attack vector?

3
el_terrible_•

Why does the malware app not even tell you what it did or if it even found an infection or not?

3
sarctastic•

What, exactly, is/was the vector of attack?

Just keep asking that until you get a straight answer.

3
Stompya•

I would like to have an ELI5 type answer: is it safe to let my QNAP connect to the internet, through my router?

I have tried to read up on this forum and elsewhere but it seems to get pretty technical. QNAP says, “oh it’s all good now” and users say mostly things like, “be an expert or don’t use one of these online, ever”. That’s confusing obviously and I don’t know what to trust.

3
FermiEstimate•

What are the lessons learned for QNAP going forward? Does QNAP expect to use the same approach to dealing with security vulnerabilities in the future, or will it do anything differently the next time around?

Like others, I'm utterly astonished that QNAP still has not disclosed the attack vector four months later. I'm glad I'm just a hobbyist and not someone who stores business-critical customer information on one of QNAP's enterprise servers.

3
Tired8281•

Well, obviously we want a deep dive on the infection vectors, and some discussion on what is being done to mitigate them, now and in the future. And some discussion on the failures in communicating would be nice, again with discussion on how to best prevent this going forward.

2
aks-2•

I am a consumer user, historically using Netgear NAS's, and I just purchased my QNAP in Dec'19 and then disabled if for a few weeks until I felt 'safe'. More information and transparency would have helped.

In addition to improving isolation from external network (I only need access within my local network), I would prefer to have total control of *all* external connectivity like for software updates.

Ask for better status out of the Maleware App, at least a "clean" message rather than only started/completed. I have just 'assumed' my NAS is clean because I don't see any other error messages.

2
max-goodman•

RemindMe! 6 hours "qc*nt"

1
RemindMeBot•

There is a 1 hour delay fetching comments.

I will be messaging you in 4 hours on 2020-03-04 03:39:15 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

^(Parent commenter can ) ^(delete this message to hide from others.)

^(Info)^(Custom)^(Your Reminders)^(Feedback)
1
gelfin•

Question on a tangent: have they fixed Advanced Permissions for NFS shares yet? I haven’t updated in months because they stopped publishing the last known-working firmware version, and I can find no information indicating that newer versions fix the problems (vanishing files, spontaneously changing/garbled permissions on clients). Since I can no longer revert to the working version, I need assurance I can upgrade safely. It does me no good to patch against a security threat if the upgrade itself breaks my installation.

1