QNAP removes backdoor account in NAS backup, disaster recovery app

QNAP removes backdoor account in NAS backup, disaster recovery app

QNAP has addressed a critical vulnerability allowing attackers to log into QNAP NAS (network-attached storage) devices using hardcoded credentials.

The hard-coded credentials vulnerability tracked as CVE-2021-28799 was found by ZUSO APT in HBS 3 Hybrid Backup Sync, the company’s disaster recovery and data backup solution. 

The company says that the security bug is already fixed in the following HBS versions and advises customers to update the software to the latest released version:

  • QTS 4.5.2: HBS 3 Hybrid Backup Sync 16.0.0415 and later
  • QTS 4.3.6: HBS 3 Hybrid Backup Sync 3.0.210412 and later
  • QuTS hero h4.5.1: HBS 3 Hybrid Backup Sync 16.0.0419 and later
  • QuTScloud c4.5.1~c4.5.4: HBS 3 Hybrid Backup Sync 16.0.0419 and later

To update HBS on your NAS device, you have to log into QTS or QuTS hero as administrator. Next, search for “HBS 3 Hybrid Backup Sync” in App Center, and then click Update and OK to update the application (the Update option is not available if HBS is already up to date.)

While QNAP published the security announcing that CVE-2021-28799 was fixed today, the app’s release notes for version 16.0.0415 lists it as fixed almost a week ago, on April 16th.

A QNAP spokesperson was not available for comment when contacted by BleepingComputer earlier today to provide more info on the reason behind delaying to disclose the hardcoded credentials vulnerability disclosure.

On the same day, QNAP fixed two other HBS command injection vulnerabilities, as well as two more critical vulnerabilities (a command injection bug in QTS and QuTS hero and an SQL Injection vulnerability in Multimedia Console and the Media Streaming Add-On) that could allow attackers to gain full access to NAS devices.

Ongoing Qlocker ransomware campaign targeting QNAP users

Critical security bugs such as these allow threat actors to take over NAS devices and, in some cases, deploy ransomware to encrypt the users’ files and ask hefty ransoms for a decryptor.

QNAP told BleepingComputer that they believe a new ransomware strain known as Qlocker exploits the SQL Injection vulnerability to encrypt data on vulnerable devices.

This precisely what has been happening since at least April 19th, when attackers behind a massive campaign deploying a new ransomware strain known as Qlocker started moving QNAP customers’ files in password-protected 7zip archives and asking for ransoms.

Since then, BleepingComputer’s ransomware support forum has seen a considerable amount of activity, and ID-Ransomware has recorded a surge of Qlocker sample submissions from victims.

ID-R Qlocker submissions
ID-R Qlocker submissions

QNAP devices targeted by ransomware before

Qlocker is not the first ransomware to target QNAP devices, given that they are commonly used to store sensitive personal files and are the perfect leverage to force victims into paying a ransom to decrypt their data.

In June 2020, QNAP warned of eCh0raix ransomware attacks targeting Photo Station app security flaws. 

eCh0raix (aka QNAPCrypt) returned one year later, trying to gain access to QNAP devices by exploiting known vulnerabilities and brute-forcing accounts with weak passwords.

QNAP also alerted customers in September 2020 of an AgeLocker ransomware campaign targeting publicly exposed NAS devices by exploiting older and vulnerable Photo Station versions.

QNAP customers are advised to go through the following procedure to secure their NAS devices and check for malware:

  • Change all passwords for all accounts on the device
  • Remove unknown user accounts from the device
  • Make sure the device firmware is up-to-date, and all of the applications are also updated
  • Remove unknown or unused applications from the device
  • Install QNAP MalwareRemover application via the App Center functionality
  • Set an access control list for the device (Control panel -> Security -> Security level)


Source: BleepingComputer

Leave a Reply