Synology NAS devices are currently under threat from C3RB3R ransomware attacks. These attacks are leveraging vulnerabilities discovered in 2024, prompting urgent updates to the DiskStation Manager software and related packages.
Details of the Ransomware Attacks
Reports from the 360 Security Team and Solar Emergency Response Team on October 29 highlighted the issue, with victims finding their files encrypted with a .L0CK3D extension and a ransom note titled read-me3.txt. The ransomware has been provisionally identified as C3RB3R, although the total number of affected devices remains unclear.
Synology issued a security advisory, Synology-SA-24:20, detailing three key vulnerabilities exposed during the Pwn2Own 2024 event. These vulnerabilities, officially published on November 5, 2024, have since received multiple updates as patches were developed for various DSM branches.
Examination of the Security Flaws
Despite reports from Appinn suggesting that the vulnerabilities were addressed by December 2024, Synology’s records indicate several patches were released in November. A critical flaw, CVE-2024-10441, was identified in the DSM software, bearing a CVSS score of 9.8, allowing unauthenticated remote code execution.
The advisory also includes CVE-2024-50629, a webapi flaw that enables attackers to read limited files remotely, and CVE-2024-10445, a certificate validation issue allowing adjacent attackers to write files. These vulnerabilities hold CVSS scores of 5.3 and 4.3, respectively.
Uncertain Attack Vectors and Precautionary Measures
Reports have yet to determine which specific vulnerability was exploited in these ransomware incidents, or if multiple vulnerabilities were used in tandem. Preliminary investigations by Solar noted a compromised device running DSM 7.4.1-90080 Update 1, though the precise entry point remains unidentified.
Synology’s findings point to patched but older vulnerabilities, though the possibility of a new zero-day exploit has not been confirmed. The company has released updates to address two CVEs, but the exact method of attack initiation is still unknown.
Protective Recommendations for Users
Synology has issued updates across various DSM versions, including 7.2.2-72806-1, 7.2.1-69057-6, and others. Users are advised to install the latest supported updates and review all software components. Appinn’s report suggests restricting internet access to DSM management, utilizing VPNs, monitoring for unusual activity, and enabling two-factor authentication.
Maintaining independent backups, either offline or off-site, remains crucial for recovery from ransomware attacks. While updating software is imperative, it won’t restore files already encrypted.
