QNAP QLocker Continued - How Angry Should People Be and What Could QNAP Have Done

so go on there mate how many backups are you rocking these days be honest oh let's have a look so everything would i have goes on two base seven one eight plus so that's about right right one which is a mirroring both drives are being mirrored so in a way it's a backup but i know theoretically it's not then i got also the s-118 which synchronizes with uh the seven one eight two bay cool and i also do very often uh external backup usb plug-in and backup and so i would say i have three copies technically i was gonna say i'd say two a push there uh you've got any cloud anything like that yeah i got um dropbox i got um drive google drive and i got snow g cloud which probably not gonna count as a as a a three to one backup option and there you go that is the world's dullest dating video if you're single and interested eddie's available [Music] hello and welcome back here we are back on last compares here and today of course as the thumbnail described we are talking about q locker it's been well over a week since this really kicked off we talked about it a matter of days ago now and of course things have progressed a little bit further but today's video is more about talking about q locker and me and eddie kind of not really positioning blame but definitely talking about what people's expectations are of qnap what people's feelings are about q locker and somewhere in the middle there because there's a lot of ambiguity between expectations of the end user and their storage and what qnap should or should not have to commit to generally in their product uh me and eddie eddie obviously we're doing this on zoom we're far away um but eddie here and me do have slightly different opinions on some of this which we're going to go for in this video uh before we go any further it's worth highlight if you don't know what q locker is we've already done a big old video i recommend you check that one out otherwise this video is going to be largely useless to you but long story short q locker was a malware attack that affected qnap devices qnap devices that were connected to the qnap cloud system and the vulnerability was utilized via that remote access system there to get into and inject commands into qnaps that made them start zipping up smaller files zip them up real small and then it left a readme text that was like hahaha your files are knackered um you have got to go to this web address this web address here give us 0.01 bitcoin i believe which is about 500 nikka i think give or take it's a knicker these days and then from there they would give you the pass key and you could unzip it and lots and lots and lots of people are pissed about this so this is still ongoing there are resolutions firing around some of which i talk about in the comments but straight away eddie so tell me what is you what do you think on this what are your pros and cons what is your opinion on this yeah it's actually very funny that they call it malware because to have malware you actually need to have virus file on your nas where in this situation it wasn't the case because what happened is hackers took advantage of a vulnerability on qnob hbs which is a hyper backup sync software so which you normally would use to synchronize with your dropbox or your on google drive cloud or and other synology and um hacker just figured out that um so there is a loophole that you can get through at the nas and um they didn't have actually a access to a files as you would normally but they had just had access to like a command line so they could send linux commands to this nas and do things like that so they they took advantage of built in uh 7-zip um program what is there so all they did they just activated like say let's encrypt everything what is on this on the 7zip and use this key so to get this key you need to contact them or if you were not panicking at the first um and uh i actually understood what's going on you could have actually gone in the back in the back though you know like a backhand and see that the zips are still happening and these are the passwords which are used to uh zip all these files up so you could have taken the pass password throughout the process and closed for the most part now but of course when uh you're being attacked the always first rule is disconnect uh from ethernet or disconnect the power so this is what um about the power but that's a bit strong really bad yeah once they disconnected they lost the chance to actually get a key so this was probably what hackers actually one thing i would add for people at home as well some people actually did have data taken a lot of that is because when these vulnerabilities yes because you can one of those commands of course can be send this file to this location because um through the commands you can you can command us to do anything so that's why also lots of companies who got affected they need to go through these gdpr rules because within 24 hours you need to actually evaluate the damage and notify every single person business whose data could have been stolen because they can take them to court this is a really dangerous game don't know i mean for me like the idea that people's data like they're holding onto this pile of data which to them is ultimately useless is obviously a great it's quite frustrating for them and obviously when this vulnerability happened um i'm willing to bet that nazis that had particularly poor security almost certainly the hackers were pinged back to go these ones are particularly susceptible and that is where i think a lot of the data transmission probably took place more than in any other occurrence yeah because this is amazing this is the thing what why people got affected because those people who didn't have installed um all the um latest firmware and antivirus and malvern all of these things and those who are playing with something like port forwarding and things like that those are the people who good actually affected because from outside worlds if i'm going to switch on my nas here in office you won't be able to get into my now there's no chance you can't first thing what you need to get through is your router that's your first firewall your first wall to get through and once you get through the wall then you can start attacking the nas and and anything else but in this situation if someone could attack your nas this is already uh something to think of that your other devices could be affected as well in your uh in your uh network not just this now you might not know that you have opened this door for others to come in and do what they want with any device is your computer are you saying like when people set up the mic unit cloud service there is the option in this this is not quite because this other thing what people got wrong if you had qnob cloud enabled this is your safe way of connecting to your nas this because lots of people think like they all usually google like um how can i connect to my nasa through the internet and first thing what they're going to find is enable port forwarding and this is when you got got into trouble because without knowing what you're doing with support forwarding you're just opening a door because this is what port forwarding is it's like saying i'm going to open doors it but i'm not going to tell anyone which door i opened and you can guess through this though and then if you don't have firewalls or or you don't limit which ip can get through this door then you're just saying to neighbors like okay all of you are welcome as long as you know which door is open you can come in there's no someone bodyguard by the door saying like oh you don't have an id to get in so it's very dangerous because when you go when you enable cloud link what happens is you don't open a door you open a door from your nas to a qnap server which is safe and secure this is a tunnel what you created and then when you drop that it is because it's it's easier to keep safe a skewn observer rather than every single tune upon the world isn't it easier just to make one big castle which is uh having strong walls so how it works is that with qnap cloud link whenever you're outside the home you want to connect to your nas you first connect to qnap server and then qnap is communicating to your nas and that's that's the mistake with everyone saying oh quickly disable cloudlink that's nonsense don't disable port forwarding disable anything else what can let people through your router and zero defenses and enable your cloud link that's your safe way of connecting same like synology um quick connect is the same thing because one of the i think a lot of people one of their that i would argue people's disappointment in some places here they are getting a nas they are connecting their data to getting all their data and then connecting it to the internet and whether they're managing an expectation where they think they shouldn't be allowed to do this unless it's safe or they're being told it's safe when it's not i think a lot of people that's their big disappointment that they're taking them as they're using the online services we just talked about there and they've suddenly walked away and gone well it must be safe because i've been given the impression that it is safe is that a reasonable assumption or not because i think once you plug in ethernet cable it doesn't mean you have connected to the internet yes you could potentially get out to the internet through your internet but you need to make this whole you need to punch cloud when people are utilizing the myqnap cloud services to connect they are doing so in the feeling that things are bulletproof and it does not no one has no one has taken advantage of um cloudlink they didn't they took advantage of a poor software which is hbs which is annoying because this is something you're using to backup your your devices but they took advantage of this thing not not the cloud link stop there for a second um real quick are you 100 certain about what you're saying yes 100 percent it didn't take advantage of cloud link because we can call it okay cool just making sure one minute no what's your next point on your list wait i'll finish what i want to say actually oh cool because the other thing like what cued up response was after this attack they were saying like these are the things to do to keep your nose safe and then they were saying like change the password yes you should change password but this wasn't something what you would prevent this from happening or or delete that um admin account or something this is something they are uh forcing people to have by default admin account but yes you should change your admin because that will take extra time for a hacker to to guess what sort of usernames actually have admin rights on your nas so if you create some x one one two username that's going to take quite a long time for hacker to figure out that you need to attack this account and uh obviously root accounts always need to be disabled which they do by default so two-step two-step modifications as well but these are all of these things what they are saying this is this is for preventing someone trying to physically log in into your nas or trying to do brute force logging into your nas this this is not something about um preventing a loopholes you know because to prevent something like this to happen again you can't because you need to think of this as a computer like your windows for example you need antivirus because if you think that you installed antivirus and now your computer is safe that's not true it's not true because how it works all antivirus programs is that antivirus is creating a patch only when someone gets attacked so as today as right now my my computer is vulnerable to certain things which no one in the world knows when i get hit i report that argo was hit and then um these of software makers are the patch makers they're quickly creating a patch for this vulnerability but always in the world that was going to be the case that someone or a few of people will be hit by this virus there's no way of escaping it seem like a flu or any like disease you can't make a vaccine wow someone having too soon man too soon so the thing is is this queuing up they they did what they have to do of course they could do things quicker and be more open to things but um they they detected that there is a vulnerability and they created a patch and if you had antivirus on your nas system you would have this patch applied and you would be safe and what about people's feelings at the moment um about how their data is locked up now this is something i've talked about already uh in the previous video and i do think an element of people's annoyance definitely not the lion's share most certainly not the lion's share but a decent chunk of people's annoyance it's their feeling that their data is now lost to them it's trapped to them and encrypted and they don't want to facilitate um this whole ransomware thing by paying so as far as they're concerned they're annoyed at qnap that they felt they were sold a backup and their data is now lost to them now i know this is something i've touched on before in the other video but i'd be really interested to get your viewpoint on that yeah exactly lots of people think that i got this to be now that's my backup look obviously those two drives are backing each up but you can't yeah exactly but you can't call it a backup because what if there is a fire flood or burglar runs in and takes your nas that's not the backup it needs some a second copy away from the device so either it's usb or cloud or another nas or something you need uh something like that to prevent from the it's not just hackers hackers is probably the least of your problems but you could have more likely the stuff that they're going to be data of corruption because you lost electricity or something or kids were playing these drivers and pulling out right you got more risk than hackers i think in this case of course it's annoying because you think like um i bought this device and i should be safe but um you can't you can't think like that you need to think back up always and do you not think um when people are getting their nose and they're backing up from their phones their tablets their whatever and it goes on to the the nas and therefore as far as they're concerned that's a backup and again i i appreciate that is most certainly not a backup because in some cases they then delete it off those devices and that's the single copy but a lot of people would argue that the idea of having another layer to their backup buying a usb buying another nas getting a cloud account these are all additional expenses um and again i i think it is worthy i think you should value your data by how much it costs to lose it not how much you think it costs all the hardware costs but still nevertheless do you think qnap have maintained their remits they have done everything with their hardware that they said it can do and should do um yes i think that they in general of course they did what they promised they have um because not what is now is the two bay raid box so great worked you got those two two copies you could have enabled your encrypted data they also gave you option to do snapshots why you didn't do that if you did the snapshot even if this ransomware hit you you could just like say whatever i just wrote back to yesterday's version i got all my files back so if you you can think of this nas as a backup if we want to physically go those two disks in there copying each other and not just that if you enable snapshot and versioning then not only you got two copies you also have several copies of single freaking file which you can go back in time so you can treat it as a backup but you just need to think what um what vulnerabilities what sort of um disasters can happen not just hackers you always need to think about other things like burglars and fire and things like that and what about and just before i because it later we're going to move into a section in a bit where i want to kind of think what i think qnap should be doing moving forward from this before we get there um when it comes to people being notified um because a lot of people again are highlighting that this is a vulnerability that was brought to qnap detention a while ago and a lot of people have questioned how the brand basically one responded and two how they alerted their end user base i mean again what is your opinion on that this idea that i i i might have a queue up i've got i genuinely got a qnap next to me here that i'm using for a video and this now here i have a preset routine of when i'm setting it up but generally because i'm using a lot of these for different videos i won't attach a lot of my personal information to them because i'm going to be wiping them constantly but a lot of people have only got the one they may have provided their personal information they may not have but about letting people know so what do you think of that yeah they did a poor job of communicating but um it was a very funny i watched on youtube as well uh someone who got effective he said like look if hackers could figure out this loophole of and then affect the nas why couldn't qnap do the same thing you know if hacker thought oh there's a hole so qnap should utilize the same hole and employ the forced patch for these whole nazis that was so funny that they could break into their own nozzles and fix it but seriously obviously they could they could check these things because even with your broadband router if you could virgin bt or any other company uh if they are up the game they will always um do scans on their behalf and and check if there are any ports open if there are holes in your system vulnerabilities and they will send you email if not even call you saying that listen you got these ports open it's not safe you're going to infect your computers they do that and the same qnap could do as well they could do their own scans saying like oh i these are all queued up devices i'm doing daily checks i can get through these ports are you sure you don't want to close them up or use um some other means of connecting like vpn or um qts cloud or something so they could have done better job that that's very true the people who did um have malware remover up they uh they could have set up their email alerts so if it's happened they could have received email when they had the patch you know but they did a really bad job actually yeah not communicating when it comes to notifying end users i think there is the email notification systems pretty straightforward quite easy um sms and text-based notifications it is not very user-friendly in the in the user interface to set that up obviously because of call plans and regions and stuff like that yeah there's no easy way app pushes um i'm not sure if there's desktop pushes i'm not sure if that's a thing if you use there are ours are assessing um on this feed then you could uh install it into your daily feeds check on your windows or something but why would you do that the fact that you are doing something like that using a feed or checks manually on your behalf then that already proves that there is a mistrust on the brand yeah i mean brand brand is good means of emailing people yeah but if we move into uh this next bit um so this is kind of this is going to be more me but this is what i think qnap these are the things that people are crying out that qnap either should have done or should do moving forward but there's going to be a large area of contention from a large proportion of the user base so the first thing that lots and lots of people you kind of half touched on it there is the idea of forced updates the idea that the nas should force updates internally that it should make sure if there is a new firmware version it should stick it on there if there's a new firmware version or of an application there shouldn't be a do you want this it should be just bang it on there now i personally disagree with that i do disagree i'll be interested to hear what you think but although i think that might have solved this for some people because there are people right now as we speak that have got a nas in a cupboard in a draw in a room in a house in a shed in an attic that has been connected and probably has about 700 updates waiting and one of the biggest um issues with this vulnerability that's been highlighted is obviously the older your firmware the higher the statistical likelihood that you are vulnerable because of patches that have come later on so on the one hand i have to concede that forcing updates in the future may well avoid things like this it still doesn't make it foolproof as you rightly point out but forced updates if the qnap did that if they actually said right in the next version we're forcing updates we've listened to you a number of you have said if you did update and been more on the ball and told me those updates either god done this why are you giving me the choice you should force it if they did that how would you feel about the brand if they forced the updates not always you want something like that because um few apps especially if those are third-party apps they got dependencies on other things so if you're gonna update for example a new version of database or php or or any other bare bones in your nas you might actually disable an app you know because in some situations maybe i have backups i don't care about these uh old viruses because i know if something will hit me then i can recover but if i run email server or or web server i'm not gonna now go for update which is gonna break entire uh my business model just so that i'm safe for this virus which i don't care of if it's going to hit me then i'm going to deal with it but i got the backup or i got maybe two nazis which are doing this some high availability once that other case over sometimes it's more important to stay in the business rather than you know be protected of a virus which which wouldn't actually affect your business so i think some in some cases some apps should have um compulsory updates like in this case it was a hybrid share sync which um has no dependencies this is just simple backup solution you're backing synchronizing your cloud or synchronizing to your other nas is just for backing up this is app where qnap would have um could have forced an update and no one would be actually affected but if they wanted to force update like they um for example for databases or something because they said they have uh multimedia uh vulnerabilities or sql injection uh this is already something what uh you should um consider on your own yes there is vulnerability someone can guess through this app but not always you want to do the fix so another thing people have raised and again you kind of half went this way as well um is this idea that if you're going to have a nas that is connected to the internet that is going to be connected in some way that has an open door be it with kinect cloud be it with just portfolio or whatever if you're going to do that the nas shouldn't let you unless you have at least two backup or recovery options in place this idea that people should only be allowed to have access and again to me that's so strict yeah it's a nice thing like when sometimes they're asking you to create a password and then you spend ten minutes of creating password says you need to have small letters also you need to have a special symbols you need to have the numbers and you just will keep another you just want to smash that thing and i understand it's they're doing that for a reason but at the same time you're right that level and also the cost of it i imagine would be quite prohibitive to a number of people the idea that they would have to be like oh cool i've just bought this now for drives oh i've got to buy a usb and i've got to buy a cloud account wait i've got to buy another nas and i think a lot of people would get frustrated before they even heard that ransomware was a viable option yeah exactly i think it would be enough for on their side on kieran's side just to keep on pinging these old nazis all qnubs uh looking for vulnerabilities that would be enough already because then you send the email you can ignore email or you can uh take action and say that you're you the way you you're doing things i wouldn't do and it's not safe and then it's your choice to do something about it because sometimes you really don't care about vulnerabilities if you're just using that nas for example torrents or something you don't care what's happening with that nas all you want is just like open that port do what you want and i guess that leads on quite neatly on to the last recommendation and this is one that's i think has less traction anywhere else but i do think it's one that i think a lot of qnap supporters have put out there and it's the idea that when you sign up to the device you set it up for the first time and then very early doors it goes do you want access to my qnap cloud and you can click skip and then later on it's like oh do you want to add a user account great to go for that but it doesn't after that it really doesn't push you shouldn't really be using your admin account day-to-day why aren't you using two-step verification we need an email from you and to verify that email we need a phone number from you andre and it's a lot of the time because they have the security counselor i don't know if you've seen or utilized i know you're more of a synology guy but they have the security council on there which basically does a whole scan of your system and it goes right these are the things that are problematic and some of them are pernickety in the extreme like your password's not that hard sort of thing and there's more to it than that but they also have that and they have all the stuff with the antivirus and malware and all the other scan stuff on there but despite all of that there's very little push to go we aren't going to let you go any further until you verify an email verify phone number enable two-step stop using the chuffing admin account that sort of thing and all of these although technically they may not prevent malware in the grand scheme of things in the same way they're all very conscious security things that people either don't know that they can enable because if they've been told they might have enabled it or two if they choose to ignore that then the onus then sort of gets spread out a little bit i mean again if you set up a qnap for the first time eddie and it said to you right we need an email from you to verify so we can alert you if something happens with your box and we're saying to you we need to have some sort of push notification system otherwise we're not going to allow you to open ports we're not going to allow you to activate the internet how do you feel about that if you would that depends how you presented usually because uh if you just say oh we need your email address and don't explain why then obviously you want to resist and you're going to give some fake email address just to get through that step but if they're going to actually show you benefits of having email address then definitely you would opt in because then you would they would say like we're going to send you email only in urgent cases if something is not safe you know we're gonna be testing your nas your vulnerabilities from our side and if we find something we're always gonna let you know we're not gonna send you any marketing rubbish and anything like that then if the message is clear and help helpful then why wouldn't you opt in i think um one of the good examples i think i raised this in the other video i'm sorry to be repetitious everyone but um one offer i think out there one of the best examples of update handling um has always been for me gaming consoles because most gaming consoles and particularly individual games within a console so if you think of the console as a nas and the games as apps lots of games and the consoles themselves when a new firmware patch comes out they're like oh there's a new firmware patch do you want it if you don't have to have it we are not going to let you play online we aren't going to let you use online services and mainly their argument is to do with cheats stability and stuff like that but the resonance people have accepted that in console gaming culture as a thing they will go right i don't want to use the new firmware update until i've watched a bunch of people didn't brick their ps4 but at the same time they accept that it's part of the culture of gaming that they need those updates to access online services or anything even partially related to the apps and their online services so i think that kind of logic would do very well if nas companies really embraced that methodology again i appreciate what you want to scream at me now is businesses would hate that but i still think it would be a very s it would be a smart move forward not just for qnap but generally for the industry exactly because the problem is with these updates that um they don't think about logistics of delivering these uh updates because when you look at uh apple for example they will download that update already in the background so you don't need to think about it so it's going to be sitting there and it's going to be saying yeah maybe you want to update and you say no i don't want to update now maybe that they can say maybe you want to do it during night because we have noticed that you're inactive during night so probably we're not going to interrupt your daily routines with this stupid update so we can activate it when you sleep and same if queued up and synology would do the same approach and learn and and and bend around people lives then these updates would be more natural you know because it because like windows you don't want to do updates uh nine o'clock in the morning when you know just when i just start working you know but if they're not saying like oh okay install or remind me about this update at 9 00 pm or do it one at 1 am in the morning yes why not thank you and it's smooth you know but that's that's that's the problem again it's at the moment it still comes down to how chin up is responding to people and right now i mean people are finding ways to recover the encrypted data and again i think people are intentionally being rather even even now i'm slightly hesitant to talk about some of the means and ways that people are recovering data and i think a big part of that is the first time people spoke out properly straight away the um the the uh the vulnerable the hackers changed their method the key gen and stuff like that uh the way it would be because you could share the thank you for everyone so they changed it so i think there is an argument i think qnap themselves probably raised this argument like they didn't want to shout too loud about stuff because they would say oh no then they'll change what they're doing and we have to root this out we didn't want to talk about it until after the firmware update but i think we can be frank that's a it's a moderately weak excuse exactly because they also probably realize that there are still so many nazis still alive which cannot be updated to this latest firmware even because the support has ended everything has ended so there's there's nothing qnap can do with those nazis they can't patch them anymore they're too old but they know that when those people will be hit they'll be shouting aloud and they'll be blaming you enough even though it's not supported that us anymore it's old and they don't want the shot you know it's scared but they they supposed to they supposed to shout i mean again we're going to wrap this video up in a sec but if you are watching this and you've been affected by q locker do you know what even if you've been affected by age locker that's just coming in we're going to be covering that in a wee bit um can you do me a favor in the comments if you were affected don't worry don't have to go nuts or anything just put your model id i think it'd be very interesting to see the models that are affected because of all the information i've read online it's generally um a certain range of model it's a certain price point of model and it's certainly a different age group and it's it's very interesting to see because i think it would be so useful for our side yeah it would be so so useful to know what exactly where is that correlation what is similar in all these affected cases did they all have old firmware did they not have uh this antivirus and malware mode did they have open ports did they have what is that similarities you know in all the situations because then we could actually investigate and then say like this is what happened you know and this is how we can prevent this off happening again no why we he does mean the industry there's only two of us um but yeah other than that um i think we're going to call it a day there we're going to try and do at least one of these a week from now on but um real quick guys if you are looking for any kind of assistance on network attached storage or you've been hit by q locker or you are concerned about the security of a current or future purchase of nas go into the comments there's a free link there to the free advice section that nas compares it's not paid it's unbiased again it's run as a service it's not going to be the quickest it's only me and him doing it so do me a favor be a bit patient extra day but it's free advice home or business we will advise you every step of the way and hopefully make sure your data is nice and tight um eddie have we missed anything uh probably but we're gonna address it in comments probably isn't it absolutely we'll be banging it off down there in the comments but otherwise thank you so much for watching eddie i will catch you later everyone else cheerio have yourself a lovely weekend bye bye

Channel: NASCompares

Views: 10,556

Keywords: NAS Server, NAS Drive, NAS Guide, QNAP HACK, QNAP NAS HACK, QNAP NAS RANSOMWARE, QNAP QLOCKER, QNAP VIRUS, QNAP HACKING, NAS RANSOMWARE, NAS VIRUS, NAS DRIVE HACK, NAS BACKUP, BEST NAS BACKUP, BEST NAS FOR BACKUPS, QLOCKER KEY, QLOCKER PASSWORD, CVE-2020-2509, CVE-2020-36195, NAS COMMAND INJECTION, QNAP 7Z FILE, QNAP STOP QLOCKER, QNAP UPDATE, ARE QNAP SAFE, ARE NAS SAFE

Id: ZjIQVwhXKl8

Length: 35min 16sec (2116 seconds)

Published: Fri Apr 30 2021