Synology User Falls Victim to Ransomware Attack

Cyberattacks are becoming increasingly frequent, but cases involving experienced technical specialists remain particularly notable. A user who considers themselves a technology enthusiast recently shared their experience on Reddit: their Synology DS918+ network-attached storage (NAS) was hit by ransomware. Although the user managed to avoid permanent data loss, the incident serves as a lesson for anyone managing home or office servers.

What caused the attack?

An investigation by the victim revealed that the attack exploited the CVE-2024-10441 vulnerability. This remote code execution (RCE) flaw has been known for 18 months, yet the user had not updated their device. Two primary factors led to the breach: the device's web interface was exposed directly to the internet, and the DiskStation Manager (DSM) operating system was approximately 18 months behind on the latest security patches.

System issues and user responsibility

It is important to note that Synology’s update system can be confusing. As some users point out, the interface often reports that the system is "up to date" even when critical security patches require manual installation. Furthermore, individual packages, such as those fixing PHP vulnerabilities, require separate updates that many users overlook. The company has also faced criticism for lacking a direct channel, such as email alerts, to notify users about critical security threats.

How to protect yourself

This incident serves as a reminder that exposing network devices directly to the internet is a major risk. Security experts recommend that such storage devices should always be accessed via a VPN or an SSH tunnel. Tools like Tailscale allow users to access their data remotely and securely without exposing them to the public internet.

Fortunately, the victim employed the "3-2-1" backup strategy—three copies, on two different media, with one copy off-site—which allowed for a full data recovery. For users relying on Synology or similar solutions, this case is a reminder that relying solely on automatic updates is insufficient. It is essential to regularly check security bulletins and ensure your device is not open to the public internet.