Tons of compromised NFS consumer devices

#1

Post by mnigsch » Wed, Apr 17, 2024, 1:19 PM UTC

Hi all,

I've got a service up and running with protection. 5 Minutes after I get it hooked up the internet, it's started being attacked from all over the world from (seemingly) synology NFS servers.

It's interesting as the attack is coordinated: names and passwords are tried out in alphabetical order, and the attacks come from all over the world with no distinction east / west / ... from Spain to Honolulu to China, Russia and Australia, there's full coverage.

The endpoints indicate that it's consumer devices connected often via ADSL.

I'm putting this up here to (a) maybe reach somebody from synology - my best guess at the compromised software from peeking into some of the IPs. (b) warn you: update your NFS :) (c) seek advice on best practice: clearly, no blacklisting helps against such an attack. 2 Factor authentification does, as it's just mere password bruteforcing (seemingly). Any idea what else to do?

Best.

Below an extract of the attack logs, if somebody wants to have a look.

Time User IP Address Location Protocol Client Status 04/17/2024 14:29:49 OFFICE 89.75.176.214 Lublin, Poland HTTP/HTTPS - Failed 04/17/2024 14:29:01 office 188.60.121.83 Lutry, Switzerland HTTP/HTTPS - Failed 04/17/2024 14:28:38 office 61.19.123.18 Ubon Ratchathani, Thailand HTTP/HTTPS - Failed 04/17/2024 14:27:50 ntust 116.23.135.120 Guangzhou, China HTTP/HTTPS - Failed 04/17/2024 14:27:37 ntust 218.82.186.204 Shanghai, China HTTP/HTTPS - Failed 04/17/2024 14:26:57 norbert 188.121.164.207 Bratislava, Slovakia HTTP/HTTPS - Failed 04/17/2024 14:26:22 norbert 75.156.120.112 Sechelt, Canada HTTP/HTTPS - Failed 04/17/2024 14:25:56 nicole 69.180.188.212 Minnetonka, United States HTTP/HTTPS - Failed 04/17/2024 14:25:48 nicole 5.31.22.91 Dubai, United Arab Emirates HTTP/HTTPS - Failed 04/17/2024 14:25:10 nick 121.153.90.216 Tangjin, South Korea HTTP/HTTPS - Failed 04/17/2024 14:24:55 nick 2.101.138.82 Wirral, United Kingdom HTTP/HTTPS - Failed 04/17/2024 14:24:02 netatmo 71.234.92.164 Concord, United States HTTP/HTTPS - Failed 04/17/2024 14:23:53 netatmo 114.180.176.107 Fukushima, Japan HTTP/HTTPS - Failed 04/17/2024 14:22:57 nathan 116.141.109.14 China HTTP/HTTPS - Failed 04/17/2024 14:22:48 nathan 115.160.170.182 Kai Yi Wan, Hong Kong HTTP/HTTPS - Failed 04/17/2024 14:21:44 nathalie 218.253.76.150 Central, Hong Kong HTTP/HTTPS - Failed 04/17/2024 14:21:37 nathalie 125.229.200.127 Taichung, Taiwan HTTP/HTTPS - Failed 04/17/2024 14:21:06 nath 218.90.5.182 Wuxi, China HTTP/HTTPS - Failed 04/17/2024 14:20:55 nath 61.164.90.78 China HTTP/HTTPS - Failed 04/17/2024 14:19:51 natasha 80.235.208.146 Halesowen, United Kingdom HTTP/HTTPS - Failed

Re: Tons of compromised NFS consumer devices

#2

Post by RGamma » Wed, Apr 17, 2024, 1:39 PM UTC

Why do you think these come from Synology NASes specifically? Could be any sort of host, e.g. IoT garbage.

Botnet spreading to similar devices?

Re: Tons of compromised NFS consumer devices

#3

Post by mnigsch » Wed, Apr 17, 2024, 6:01 PM UTC

RGamma wrote: post #2

Why do you think these come from Synology NASes specifically? Could be any sort of host, e.g. IoT garbage. Botnet spreading to similar devices?

All I checked (which had open ports) were synology devices ..

Re: Tons of compromised NFS consumer devices

#4

Post by RGamma » Wed, Apr 17, 2024, 7:05 PM UTC

mnigsch wrote: post #3

RGamma wrote: post #2

Why do you think these come from Synology NASes specifically? Could be any sort of host, e.g. IoT garbage. Botnet spreading to similar devices?

All I checked (which had open ports) were synology devices ..

FWIW there's https://www.synology.com/en-us/form/security (the title says the form is for "security-related questions", but weirdly it requires a PoC, so not sure whether that form would be appropriate). I don't have a direct line either.

Most likely explanation IMO: Badly secured access like usually...