● Covered by 3 sources · 3 reportsLow impact2 negative1 neutral
Internet-Exposed Synology NAS Hit by Ransomware Due to Unpatched 18-Month-Old Flaw
Key points
- Synology NAS exposed to internet and unpatched for 18 months.
- Ransomware attack exploited CVE-2024-10441 vulnerability.
- Synology's UI may report devices as updated despite pending critical patches.
- Lack of direct security vulnerability notifications from Synology noted.
- Synology warned customers about C3RB3r ransomware attacks.
- The attacks exploit vulnerabilities patched in December 2024.
- Synology urges users to enable automatic updates for DSM.
- CVE-2024-50629 allows reading files.
- CVE-2024-10445 allows writing files.
- C3RB3R ransomware locks files with a ".L0CK3D" extension.
- CVE-2024-10441 has a CVSS score of 9.8.
- CVE-2024-50629 has a CVSS score of 5.3.
- CVE-2024-10445 has a CVSS score of 4.3.
Ransomware Attack on Exposed NAS
A Synology DS918+ Network Attached Storage (NAS) device owned by Reddit user NakamuraHwang was compromised by a ransomware attack. The attack encrypted files on the device, which was directly accessible from the internet and had not received security updates for approximately 18 months.
Exploited Vulnerability
Investigation of the NAS logs and operating system files suggests the attack likely exploited CVE-2024-10441, a remote code execution vulnerability that was publicly disclosed a year and a half prior to the incident. The user had a 3-2-1 backup strategy, preventing data loss.
Security Practices and Device Exposure
The incident underscores the risk of exposing network devices directly to the internet without protective measures like a VPN or SSH tunnel. Security best practices advise against such direct exposure to mitigate potential threats.
Synology Update and Notification Issues
Reports indicate that Synology's DSM operating system interface may incorrectly display a device as up-to-date even when critical security patches require manual installation. Additionally, Synology reportedly lacks a direct email notification system for critical security vulnerabilities, which could leave users unaware of necessary updates, particularly for older models or less technical users.
Updates
- C3RB3R ransomware locks files with a ".L0CK3D" extension.
- CVE-2024-10441 has a CVSS score of 9.8.
- CVE-2024-50629 has a CVSS score of 5.3.
- CVE-2024-10445 has a CVSS score of 4.3.
- Synology warned customers about C3RB3r ransomware attacks.
- The attacks exploit vulnerabilities patched in December 2024.
- Synology urges users to enable automatic updates for DSM.
- CVE-2024-50629 allows reading files.
- CVE-2024-10445 allows writing files.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2024-104419.8 CRITICAL CVE CVE-2024-506295.3 MEDIUM CVE CVE-2024-104454.3 MEDIUM CVE CVE-2021-260849.8 CRITICAL CVE CVE-2021-2220510.0 CRITICAL CVE CVE-2023-225189.8 CRITICALHow outlets covered it
Synology is urging customers to update their DiskStation Manager (DSM) software after ransomware attacks exploited a vulnerability patched in December 2024. The attacks aim to encrypt data and extort ransom, with reports indicating C3RB3R ransomware is locking files with a ".L0CK3D" extension. This incident highlights the ongoing threat to NAS devices from ransomware, even after patches are released.
Synology has issued a warning to customers regarding a surge in C3RB3r ransomware attacks targeting its NAS devices. The attacks exploit vulnerabilities patched in December 2024, and users are urged to update their DiskStation Manager (DSM) software immediately to prevent data encryption and extortion.
A Reddit user's Synology DS918+ NAS was encrypted by ransomware after being exposed to the internet with an 18-month-old unpatched remote code execution vulnerability (CVE-2024-10441). The incident highlights risks of direct internet exposure and issues with Synology's update notifications for older devices.