05-10-2019, 01:53 PM
Buenas,
QNAP ha publicado consejos de seguridad para evitar este tipo de RansomWare en nuestros NAS QNAP, especial mención a los que usáis en PHPMyAdmin. Ya lo hemos comentado por aquí alguna vez. No dejéis el Password por defecto nunca.
https://www.qnap.com/es-es/security-advi...-201910-02
Security Advisory for Muhstik Ransomware
The Muhstik ransomware is reportedly being used to target QNAP NAS devices. Devices using weak SQL server passwords and running phpMyAdmin may be more vulnerable to attacks.
We strongly recommend that users act immediately to protect their data from possible malware attacks.
If you have any questions regarding this issue, contact us through the QNAP Helpdesk.
Recommendation
To avoid attacks, you must:
[*]Enabling Network Access Protection
[*]Disabling SSH and Telnet Connections
[*]Changing the System Port Number
[*]Changing the SQL Server default password
[*]Updating phpMyAdmin to the latest version.
Saludos,
QNAP ha publicado consejos de seguridad para evitar este tipo de RansomWare en nuestros NAS QNAP, especial mención a los que usáis en PHPMyAdmin. Ya lo hemos comentado por aquí alguna vez. No dejéis el Password por defecto nunca.
https://www.qnap.com/es-es/security-advi...-201910-02
Security Advisory for Muhstik Ransomware
- [b]Release date:[/b] October 4, 2019
- [b]Security ID:[/b] NAS-201910-02
- [b]Severity:[/b] High
- [b]CVE identifier:[/b] N/A
- [b]Affected products:[/b] QNAP NAS devices
The Muhstik ransomware is reportedly being used to target QNAP NAS devices. Devices using weak SQL server passwords and running phpMyAdmin may be more vulnerable to attacks.
We strongly recommend that users act immediately to protect their data from possible malware attacks.
If you have any questions regarding this issue, contact us through the QNAP Helpdesk.
Recommendation
To avoid attacks, you must:
- Use a stronger password for phpMyAdmin.
- Keep phpMyAdmin disabled whenever possible. Only enable this application when configuring settings.
- Update QTS to the latest version.
- Install and update Security Counselor to the latest version.
- Use a stronger admin password.
- Enable Network Access Protection to protect accounts from brute force attacks.
- Disable SSH and Telnet services if you are not using them.
- Avoid using default port numbers 443 and 8080.
- Update phpMyAdmin to the latest version.
- Log on to QTS as administrator.
- Open the [b]App Center[/b], and then click the Search icon.
A search box appears.
- Type “phpMyAdmin” and then press [b]ENTER[/b].
The phpMyAdmin application appears in the search results list.
- Click [b]Open[/b].
phpMyAdmin opens in a new tab.
- Log on to phpMyAdmin as [b]root[/b].
- Under [b]General settings[/b], click [b]Change password[/b].
The [b]Change password[/b] window appears.
- Select [b]Password[/b].
- Specify the new password.
QNAP recommends the following criteria to improve password strength:
- Should be at least 8 characters in length
- Should include both uppercase and lowercase characters
- Should include at least one number and one special character
- Must not be the same as the username or the username reversed
- Must not include characters that are consecutively repeated three or more times
- Should be at least 8 characters in length
- Verify the new password.
- Click [b]Go[/b].
The password is changed.
- Log on to QTS as administrator.
- Open the [b]App Center[/b], and then click the Search icon.
A search box appears.
- Type “phpMyAdmin”, and then press [b]ENTER[/b].
The phpMyAdmin application appears in the search results list.
- Click [b]V[/b] and then select [b]Stop[/b].
The application is disabled.
- Log on to QTS as administrator.
- Go to [b]Control Panel[/b] > [b]System[/b] > [b]Firmware Update[/b].
- Under [b]Live Update[/b], click [b]Check for Update[/b].
QTS downloads and installs the latest available update.
- Log on to QTS as administrator.
- Open the [b]App Center[/b], and then click the Search icon.
A search box appears.
- Type “Security Counselor”, and then press [b]ENTER[/b].
The Security Counselor application appears in the search results list.
- Click [b]Install [/b]or [b]Update[/b].
A confirmation message appears.
- Click [b]OK[/b].
The application is installed or updated to the latest version.
- Open [b]Security Counselor[/b].
- Click [b]Start Scan[/b].
Security Counselor scans the NAS for rules.
- Log on to QTS as administrator.
- Click the profile picture on the QTS Task Bar.
The Options window opens.
- Click [b]Change Password[/b].
- Specify the old password.
- Specify the new password.
QNAP recommends the following criteria to improve password strength:
- Should be at least 8 characters in length
- Should include both uppercase and lowercase characters
- Should include at least one number and one special character
- Must not be the same as the username or the username reversed
- Must not include characters that are consecutively repeated three or more times
- Should be at least 8 characters in length
- Verify the new password.
- Click [b]Apply[/b].
[*]Enabling Network Access Protection
- Log on to QTS as administrator.
- Go to [b]Control Panel[/b] >[b] System [/b]> [b]Security[/b] > [b]Network Access Protection[/b].
- Configure SSH protection.
- Select [b]SSH[/b].
- Specify a time period and the number of failed login attempts.
- Select [b]SSH[/b].
- Configure HTTP(S) protection.
- Select [b]HTTP(S)[/b].
- Specify a time period and the number of failed login attempts.
- Select [b]HTTP(S)[/b].
- Click [b]Apply[/b].
[*]Disabling SSH and Telnet Connections
- Log on to QTS as administrator.
- Go to [b]Control Panel [/b]>[b] Network & File Services [/b]>[b] Telnet/SSH[/b].
- Deselect [b]Allow Telnet connection[/b].
- Deselect [b]Allow SSH connection[/b].
- Click [b]Apply[/b].
[*]Changing the System Port Number
- Log on to QTS as administrator.
- Go to [b]Control Panel[/b] > [b]System[/b] > [b]General Settings[/b] > [b]System Administration[/b].
- Specify a new system port number.
[b]Warning:[/b] Do not use 443 or 8080.
- Click [b]Apply[/b].
[*]Changing the SQL Server default password
- Log on to QTS as administrator.
- Go to [b]Control Panel[/b] > [b]Applications[/b] > [b]SQL Server [/b] > [b]Change Root Password[/b].
- Specify a new root password.
[b]Warning:[/b] Do not use default or a simple password.
- Click [b]Apply[/b].
[*]Updating phpMyAdmin to the latest version.
- Log on to QTS as administrator.
- Open the [b]App Center[/b], and then click the Search icon.
A search box appears.
- Type “phpMyAdmin”, and then press [b]ENTER[/b].
The phpMyAdmin application appears in the search results list.
- Click [b]Update[/b].
A confirmation message appears.
[b]Note[/b]: This option is not available if your application is already up to date.
- Click [b]OK[/b].
The application is updated to the latest version.
Saludos,