Ransomware hits internet-exposed Synology NAS via 18-month-old remote code flaw | #ransomware | #cybercrime

A proficient administrator lost files to ransomware after exposing a Synology DS918+ web interface to the internet and leaving firmware 18 months behind on security updates. The attacker exploited CVE-2024-10441, a remote code execution vulnerability disclosed a year and a half prior.Reddit user NakamuraHwang lost files to ransomware on a Synology DS918+ NAS after exposing the device’s web interface to the internet and leaving firmware 18 months behind on security updates. The attacker exploited CVE-2024-10441, a remote code execution vulnerability that Synology disclosed a year and a half ago.

NakamuraHwang, an experienced administrator, documented the incident with technical detail. The NAS maintained a 3-2-1 backup setup, which preserved all data. The user mounted the disks on a Proxmox machine for inspection, using the mdraid layer beneath DSM to access the volumes and examine the damage.
NakamuraHwang inspected logs and operating system files and traced the intrusion to CVE-2024-10441. Synology published an advisory for this remote code execution flaw, but the NAS interface displayed an up-to-date status while critical security fixes required manual installation. The DSM manual states that automatic updates apply to units manufactured from 2025 onward; older hardware demands manual configuration.
Security professionals advise against exposing devices to the internet without a VPN or SSH tunnel. Tailscale offers a free tier that covers most home installations and removes the complexity of manual tunnel setup. NakamuraHwang’s NAS lacked this barrier, leaving the web interface open to external scanning and exploitation.
These update failures highlight a broader product issue. Synology sends no direct email alerts for critical vulnerabilities, forcing customers to monitor bulletins manually. Package updates for flaws like PHP2Shell require installation apart from core system updates. The company has shifted focus away from consumer hardware, yet it continues selling small units to regular users who may not track security advisories.
This case shows that technical proficiency does not prevent security hygiene failures. Exposure combined with patch neglect creates an open door regardless of backup redundancy. Manufacturers must close the notification gap, particularly for older units that hide available security fixes behind an up-to-date message.

Click Here For The Original Source.

——————————————————–

…………

Related