What is NAS?
NAS, or network-attached storage, is dedicated file storage that enables multiple users and heterogeneous client devices to retrieve data from centralized disk capacity over a local area network (LAN) (1). NAS systems contain one or more hard drives that are usually arranged in a RAID configuration for added redundancy and performance. Unlike general-purpose servers, NAS systems are specialized for serving files either over network file sharing protocols like SMB or NFS, or over HTTP or FTP. NAS devices typically do not have a keyboard or display and are configured over the network.
Compared to local storage, NAS offers centralization and shared access to data, better data protection through RAID, and the ability to easily expand storage capacity. NAS can be lower cost compared to SAN (storage area network) solutions, and the network protocols used are standardized. On the downside, performance can suffer compared to local storage due to network limitations. NAS is ideal for smaller environments with lighter workloads that need to share files across multiple users and devices (1).
Overall, NAS provides centralized storage and backup capabilities along with shared file access, making it a convenient data storage solution for homes and small offices (2).
Sources:
(1) https://www.techtarget.com/searchstorage/definition/network-attached-storage
(2) https://www.seagate.com/blog/what-is-nas-master-ti/
Popularity of NAS
NAS devices have gained immense popularity among both consumers and businesses in recent years. According to a report by Medium, the global SMB and consumer NAS market is expected to grow at a CAGR of over 20% from 2023-2030, reaching over $50 billion in revenue by 2030 [1]. This growth is driven by the rise in digital content creation and the need for centralized storage and backup solutions.
In terms of adoption, LinkedIn reports that over 30% of consumers and 60% of small businesses now use a NAS device for storage. Mid-sized companies have even higher adoption rates of around 70-80% [2]. As data storage needs continue to grow exponentially, NAS provides a scalable and cost-effective solution for both personal and business use.
What is ransomware?
Ransomware is a type of malicious software, or malware, that infects a computer system and restricts users’ access to the infected system. The attacker demands a ransom from the victim to restore access and threatens to delete the victim’s data if the ransom is not paid.
Ransomware typically spreads through phishing emails containing malicious attachments or links. Once executed on the victim’s system, the ransomware encrypts files and folders, making them inaccessible to the user. A ransom note appears on the infected system with payment instructions for the victim to recover their files. Payment is often demanded in cryptocurrency, such as Bitcoin, to maintain the attacker’s anonymity.
While ransomware existed as early as the late 1980s, the modern wave emerged around 2005. Attacks dramatically escalated in scale and sophistication in the early 2010s with the development of ransomware-as-a-service, which allowed cybercriminals to easily purchase off-the-shelf ransomware kits (Checkpoint). High-profile attacks like WannaCry and NotPetya in 2017 further demonstrated the disruptive potential of ransomware.
Today, ransomware remains a severe threat, with the average ransom payment in the first quarter of 2021 being over $220,000 (https://trellix.com/security-awareness/ransomware/). Attackers continue to refine tactics, targetting critical infrastructure and accessing systems through supply chain compromises. As ransomware becomes increasingly “big business” for cybercriminals, organizations must vigilantly guard against ever-evolving attacks.
How ransomware attacks NAS
Ransomware like Deadbolt specifically targets NAS devices produced by QNAP and Synology. It encrypts files stored on the NAS, preventing users from accessing their data until they pay the ransom to receive the decryption key. The ransomware exploits vulnerabilities in the NAS operating system to gain entry and launch the attack without needing any user credentials or interaction.
Once inside the system, the ransomware encrypts file shares, storage devices connected to the NAS, and backups. Everything is locked down, leaving users completely unable to access their data. A ransom note is left demanding payment in bitcoin to receive the decryption key. Without the key, it is virtually impossible to recover the encrypted data.
The attack happens quickly, encrypting even 10TB or more of data within hours. The ransomware deletes volume shadow copies and disables restore points, so users cannot roll back to recover files. It also kills processes related to backup tools like Veeam, preventing backups from running during the attack.
Ransomware like Deadbolt spreads through security vulnerabilities in unpatched NAS devices. Keeping the NAS firmware and apps updated is critical. Enabling auto-block of IP addresses after failed login attempts can also limit attacks. Strong passwords, multi-factor authentication, offline backups, and proactive endpoint security provide additional layers of protection.
Real-world examples
NAS devices have become a prime target for ransomware attacks in recent years. Some notable examples include:
In April 2021, QNAP NAS devices were hit by the Qlocker ransomware. The attackers exploited a vulnerability in QNAP’s photo storage app to encrypt user data. Over 4,000 QNAP customers were impacted before a patch was released.
In 2020, the eCh0raix ransomware targeted QNAP devices by brute forcing weak login credentials. Once in, the malware would encrypt all files and leave a ransom note demanding payment in Bitcoin.
Synology NAS devices were attacked in 2019 by the Synolocker ransomware. It was distributed via phishing emails and encrypted files with the .synolocker extension. Synology released a decryption tool to help victims recover files.
In 2018, the SamSam ransomware infected NAS devices at several organizations including the Colorado Department of Transportation. The attackers gained access by brute forcing weak passwords.
These examples highlight how ransomware remains a serious threat to NAS systems. Using strong passwords, updating firmware, and having offline backups are critical to minimize risk.
Vulnerabilities of NAS
NAS devices are vulnerable to ransomware attacks for a few key reasons. First, many NAS operating systems have security flaws that can be exploited. For example, vulnerabilities have been found in operating systems like QNAP QTS and Synology DSM that allow attackers to gain remote access and execute malicious code [1]. These vulnerabilities may exist in the OS software itself or in installed applications.
Additionally, NAS devices often lack proper backup systems in place. Without adequate backups, victims have no way to recover their files if encrypted by ransomware. Backing up NAS data regularly to an offline location is critical to avoid paying ransoms [2]. However, many NAS users fail to implement backup plans or test restores.
Finally, NAS devices are often directly exposed to the internet without proper firewalls or access controls. This makes them an easy target for ransomware gangs scanning for vulnerable systems. Proper network segmentation and access restrictions are key to reducing the attack surface.
Best Practices
There are several best practices that can help secure NAS devices from ransomware attacks:
Backups: Regularly backing up NAS data is crucial to recover from a ransomware attack without paying the ransom. Backups should be kept disconnected from the NAS device when not in use, such as on external hard drives or cloud storage, to prevent backups from being infected as well.
Access controls: Limiting access to the NAS admin interface and shared folders based on user roles can prevent ransomware from propagating. Strong password policies should be enforced and default credentials changed. Multi-factor authentication adds another layer of security.
Patching: Keeping the NAS firmware and apps updated with the latest security patches closes vulnerabilities that ransomware could exploit. Enable auto-update features when available. Test patches before deploying widely.
Other best practices include disabling unused services, restricting network access, monitoring for suspicious activity, and isolating backups from the network.[1]
Security solutions
There are several security solutions that can help protect NAS devices against ransomware attacks. Using anti-ransomware software specifically designed for NAS can prevent malware from encrypting files on the device. Some popular options include Synology’s ransomware protection, which uses behavior monitoring to detect ransomware activity.
Firewalls are also critical for securing NAS devices. A firewall helps control network traffic and block suspicious connections to the NAS. Many NAS operating systems like Synology DSM have built-in firewalls that can be configured with rules to allow/deny traffic. Additional network firewalls can also be implemented. For example, IP-based firewalls can restrict access to the NAS to specific IP addresses or ranges.
Other solutions include enabling auto-blocking of IPs after too many failed login attempts, enforcing the use of strong passwords, keeping the NAS firmware/software updated, limiting user permissions, and enabling versioning/snapshots on shared folders. Taking a layered security approach with multiple solutions is key for protecting NAS in today’s threat landscape.
Should you pay the ransom?
Paying the ransom is a controversial topic. On one hand, it may allow you to regain access to your encrypted files. According to one survey, about 58% of organizations that paid ransoms got back their data. However, paying ransoms emboldens cybercriminals and funds their future attacks. Many security experts recommend against paying.
Here are some pros and cons to consider when deciding whether or not to pay the ransom:
Pros:
- You may recover access to your encrypted data
- It is often less costly than rebuilding systems and restoring data from backups
- Paying the ransom avoids business disruption and data loss
Cons:
- There is no guarantee you will get your data back after paying
- Paying ransoms fuels more cybercrime and future attacks
- It shows you are vulnerable and willing to pay ransoms
- Law enforcement advises against paying ransoms
According to the FBI, fewer than 20% of ransomware victims who pay ransoms get back all their data. There is no honor among cybercriminals, so you cannot trust that paying the ransom will lead to recovering your files. The better path is to avoid ransomware attacks in the first place through rigorous security practices.
The future of NAS security
As NAS devices continue to gain popularity for personal and business use, it’s expected that threats against them will evolve as well. According to one report, the global NAS market is projected to reach over $50 billion by 2027, driven largely by small and medium businesses (SMBs) [1]. With more valuable data being stored on NAS devices, cybercriminals will likely increase attacks.
There are several predictions for how NAS security will need to evolve to counter emerging threats:
- Increased use of artificial intelligence and machine learning to detect anomalies and advanced threats
- Leveraging blockchain technology for secure distributed storage and file integrity verification
- Enhanced encryption capabilities, like homomorphic encryption, to allow computations on encrypted data
- Security focused hardware improvements like secure boot capabilities
- Wider adoption of multi-factor authentication and strict access controls
- Automated security updates and built-in backup/recovery tools
As IoT and edge computing continue growing, NAS devices will likely become more distributed. This will require centralized security management and visibility across locations. There will also likely be increased regulatory requirements for data security as threats increase.
Overall, expect NAS security to follow similar trends as enterprise cybersecurity, with a focus on preemptive protection driven by artificial intelligence, workforce education, and public-private partnerships. Strong NAS security will only grow in importance for protecting businesses’ critical information.
