NAS and storage server manufacturer Synology sends word this afternoon that they are informing their customers of a currently ongoing and dangerous ransomware attack that is targeting Synology devices. Dubbed SynoLocker, the ransomware is targeting Internet-exposed Synology servers and utilizing a hereto-unknown exploit to break in to those systems.
From there SynoLocker engages in a Cryptolocker -like ransom scheme, encrypting files stored on the server and then holding the key ransom. The attackers are currently ransoming the key for 0. At this time only a portion of Synology servers are affected.
Meanwhile they are still researching as to whether the newer DSM 5. With Synology still isolating the vulnerability and affected software versions, the company is asking users to take precautions to secure their servers against SynoLocker.
Along with removing external Internet access to the server, Synology is also suggesting all users upgrade their DSM to the latest version and backup all of their data so that if they have or do get it, a backup copy is safe from SynoLocker.
Not what I wanted to do today. Meanwhile for those users whose servers have been infected, Synology is advising users to immediately shutdown their servers to prevent any further files from being encrypted and to contact Synology support about the issue.
Synology is also suggesting that affected users also be on the lookout for fake Synology emails, out of a concern that the ransomware authors may follow up by hitting the infected users with spear phising attacks.
It goes without saying that while Cryptolocker and its ransomware ilk are already dangerous pieces of malware, SynoLocker is especially dangerous due to the larger quantity of data stored on a dedicated storage server compared to an average client machine or workstation, along with the potential value of the information stored on such a server.
Finally, Synology tells us that they are hoping to finish identifying which versions of DSM are affected this evening. They are also hoping to have a resolution, though admittedly if SynoLocker is as effectively implemented as Cryptolocker, then there is a distinct possibility that there may be no way to recover the ransomed data other than paying.
Synology has finished analyzing the exploit and confirmed which versions of DSM are vulnerable. The vulnerability in question was patched out of DSM in December ofso only servers running significantly out of date versions of DSM appear to be affected. In summary, DSM 5. Meanwhile DSM 4.
For those systems that are running out of date DSM versions and have not been infected, then updating to the latest DSM version should close the hole. As for systems that have been infected, Synology is still suggesting that owners shut down the device and contact the company for direct support.
Note: Without the decryption key, all encrypted files will be lost forever. Source: Synology. We will update this article once we hear more from Synology. List of encrypted files available here. Follow these simple steps if files recovery is needed: Download and install Tor Browser.
This link works only with the Tor Browser. Login with your identification code to get further instructions on how to get a decryption key. Your identification code is - also visible here. Follow the instructions on the decryption page once a valid decryption key has been acquired.
Technical details about the encryption process: A unique RSA keypair is generated on a remote server and linked to this system. The RSA public key is sent to this system while the private key stays in the remote server database. A random bit key is generated on this system when a new file needs to be encrypted.
The bit key is then encrypted with the RSA public key. The resulting encrypted bit key is then stored in the encrypted file and purged from system memory. The original unencrypted file is then overwrited with random bits before being deleted from the hard drive. The encrypted file is renamed to the original filename. To decrypt the file, the software needs the RSA private key attributed to this system from the remote server.By bootyJanuary 28, in DSM 6.
Synology Advises Users of SynoLocker Ransomware
With the original extra. With the extra lzma all drives are detected but per hour i got the message in the web gui "You are not authorized to use this service. When this happend all services are down.Synology DS420j Hands on Review
Unfortunately i cant say if the synology really reboot. I didn't know my mac from the e and i thought i boot up the synology and show in the info tab.
The MAC in the info tab is a synology mac. I changed the grub during boot on the command line. Yesterday i noticed these mistake and i corrected my mistake and changed also in the grub. An improper shutdown means the machine what hard reset. But it could be something else as well. I would recommend you open your machine and check that all cables are properly connected.
Clean fans and perhaps if the machine has beed running for many years also change the thermal paste on the CPU. The problem could also come from micro electrical interruptions. If you have a UPS uninterrupted power supply I recommend you use one. This stabilises electricity and makes sure that in case of a blackout the machine is not affected. Till now no problems. So same behavior like the DSM 6.
The release is not the issue. What could also be an issue is the compiled modules for DSM 6. You can post now and register later. If you have an account, sign in now to post with your account. Restore formatting. Only 75 emoji are allowed.I will send your request to the Product Manager. A network option you have now is to write a script PowerChute will run prior to OS shutdown that will command the Synology system down.
Has there been any movement on this case? Seems to me your system should work too. I can't think why as I can see pcns Examining the install. Did you manually install this on the Synology unit? The one I am working on does not ship with it installed by default. Choose a location. StruxureWare for Data Centers. Getting Started. Universal Transfer Switch. Mobile Power Packs. Design Portal.
Subscribe to RSS. Not a member? Join now. Latest DSM version is 5. Hi, I will send your request to the Product Manager. Thank you.In this blog post I will show you how to upgrade the RAM on your Synology and give you choices on which one to buy. Disclaimer: Memory upgrade will most likely void the warranty. If you are following my Synology Buying Guide for you know now that I have bought a new Synology for managing my YouTube files as well as drone and gopro files. The great news about it, is that you can upgrade your memory and unless my other Synologies, this time they made those slots accessible hurrahhh!!
If you are unsure if you need to upgrade, start moving some files in your drives and do some work and check the performance. On the other hand, RAM memory is very cheap nowadays so I would upgrade either way, but if cash is an issue, wait a little bit.
You are probably dying to use your synologybut I recommend you to do this before you start configuring things, because you will see blazing speeds afterwards when transferring files. Nearly every other brand of memory Corsair, G.
They have their own retail branch, support, and memory finder tool. This is an easy one: As much as you can afford and your system supports. Thanks in advance! Hi, Not that I know. You should be able to upgrade your synology. Maybe the ram you purchased is defective?
Ran for 23 hours fine, then blinking blue light. Went back to 4GB for now. Same models everywhere as gas as I aware… Not sure why they only recommend up to 8gb. Ruth, You may want to do some more research on the 16GB thing. And their statistics will base usage off of installed memory, not usable memory — so it is misleading. Curious if anyone has compared 8GB to 16GB and seen actual differences. Hi Nate, I have upgraded all my NASes and I have noticed a remarkable increase in speed though I have never measured it, no time for that kind of fun.
Please let us know if you do some tests! Ok, cool. There seems to be conflicting information out there on the webs. What if someone running 16GB of memory 2 x 8GB tried to remove one stick and then boot the Synology up again. They could do a test to see if they see any significant performance degradations.
Then, pop the 8GB stick back in and see if you see drastic improvements. Hi Nate!When I Switch on the DS and go to the package centerthe PSM package is still here and status "Stopped" If I click on "uninstall", yhe package desappears a few seconds then come back in the panel!!!
There are 3 files remaining :. But when I try to install it through the package center, a window opens saying "plex media server : failed to install the package". Do I have to back up them on an external Hard drive?
It wouldn't hurt to send off a tech support request to Synology for confirmation of what to expect and verify how NOT to erase your volumes during the reset.
These words are precisely why I suggested he confirm. It is not a definitive "no data will be lost" statement. Nothing more. This topic was automatically closed 90 days after the last reply. New replies are no longer allowed. Hi everybody My Synology DS experienced an improper electrical shutdown. I I decided to reinstall PMS. I went through the complete process found in different forum : Uninstalled PMS Deleted privileges Deleted Plex Folder proper shutdown When I Switch on the DS and go to the package centerthe PSM package is still here and status "Stopped" If I click on "uninstall", yhe package desappears a few seconds then come back in the panel!!!
How can I fully uninstall the DSM package in order to reinstall it properly? Thanks in advance. ChuckPa May 30,am 3. Hi guys. Here some fresh news. But when I try to install it through the package center, a window opens saying "plex media server : failed to install the package" Have you got any idea either to delete all the remaining files and folders, or any other idea Thanks in advance.
ChuckPa July 19,pm 9. Thanks for your help guys. I'm gonna reset after a backup of my most important data. ChuckPa July 25,pm ChuckPa July 26,pm A crashed Synology storage pool can be difficult to repair; you may need help from a professional lab to recover your data.
No matter how severe the problem is, there is always something you can do and someone who can help. A Synology storage pool crashed error message indicates that enough hard disk drives in your NAS have fallen offline to render the entire RAID array nonfunctional. The fact that a hard disk drive has been taken offline does not necessarily mean the hard disk drive has broken. There might also be file system errors causing your NAS to drop one or more disks in your storage pool.
If the storage pool is degraded, you can repair it by opening the Storage Managergoing to Overviewand clicking on the link marked Repair. If your Synology storage pool has crashed due to hard disk failure, your options to repair it and recover your data are limited.
The repair option only works when the storage pool is degraded. Hard disk drives are sensitive pieces of equipment that can only be repaired in a professional cleanroom data recovery lab by extremely well-trained experts with special equipment, and even then only temporarily. If you are dealing with one or more failed hard disks that have caused your storage pool to crash, you will need the help of a lab like Gillware to salvage the files from your Synology NAS.
A Synology storage pool degraded error message is not necessarily a sign of imminent doom, but it is a sign of impending doom. For a storage pool to be degraded means that it has lost some or all of its redundancy.
In other words, one of the drives in your NAS or more, depending on the configuration has died.
The longer you wait, the more strain you put the healthy drives in your NAS under, and if you put it off long enough, repairing your storage pool could cause healthy drives to crash, taking down the storage pool and all your data with it.
A blinking orange status light on your NAS indicates that the volume is degraded. A degraded array should be rebuilt by replacing the failed drive s as quickly as possible. Hesitation could lead to complications down the road as more strain is placed on the remaining drives. This could be an indication of hard disk failure, which is very serious, but can also indicate connection issues or a momentary glitch.
If the light persists upon a reboot and the connection seems fine, replace the hard drive in question immediately. You might also be able to tell if your NAS sounds quieter than usual. You can contact Synology to have your NAS device repaired or order replacement parts off of their website. When the status light on your NAS is orange and blinking, it indicates a degraded volume.
This means that one of your hard drives has failed, but not enough drives have failed to cause your NAS to crash. For example, a RAID 5 that loses one hard drive still has enough built-in redundancy to keep going, and a RAID 6 can lose two drives and keep on ticking.
This is the prime opportunity to replace the failed drive and rebuild the RAID; if you wait too long to rebuild a degraded RAID array, the chances that more drives could fail under the strain increase. When the status light on your NAS is red and blinking, it means the system fan is malfunctioning. If your NAS cannot properly cool itself, it will shut itself down when its internal temperature reaches a certain threshold.
If your NAS is under warranty, you can easily send it to Synology to have it repaired. You can also order replacement parts to repair it yourself. If the status light on your NAS is off, but the device is receiving power, it means that no volume has been detected. If any of the hard drive status lights on your NAS are orange, it is an indication of a hard drive error. This might not necessarily mean that the drive has suffered a catastrophic failure.
Some NAS devices will take a hard drive offline if it experiences a momentary performance hiccup and may come back online after a reboot. If the hard drive status light continues to show up as orange after a reboot, you should replace the drive.
December 19, Has your Synology crashed?But with prompt action, you may rebuild or reconstruct a corrupt RAID and get access to your data. A Synology RAID set or Network Attached Storage NAS may degrade, fail, crash, break or corrupt anytime due to mechanical, physical and logical disk errors caused by virus or malware infection, corrupt system files, sudden power loss, damaged device drivers, force shutdown, improper handling or storage, bad sectors, etc.
When a RAID set breaks or crashes, you are generally left with only one option and, i. But before you proceed with Synology RAID data recovery steps, here are some notable pros and cons of each option. Now that you know about all three possible options to recover data from a broken or crashed Synology RAID set, follow the steps given below to get back your lost files. But Drive Monitor displays more detailed information about the disk health, performance and SMART status besides an option to clone disk.
Disk cloning is important as any further rigorous data recovery scan and actions can cause drive failure, leading to permanent data loss. After the clone, replace the degraded RAID drive with a newly cloned hard drive and proceed to the next step to perform effortless data recovery from connected RAID drives. TIP: You can add a custom or uncommon file format in the supported file list for data recovery.
When parameters are not provided, the software intelligently constructs probable virtual RAID array s. Use an external USB drive or internal disk volume with enough storage space to save recovered data.
In case your system is running low on storage, save the scan information to recover data in stages. And to avoid such data loss situations, always keep atleast two backup copies of all your important files. Often, it occurs due to logical errors such as file system errors, virus or malware infection, abrupt shutdown, device driver issues, etc. You can use mdadm commands to resync the RAID array for data recovery. But mdadm works in Ubuntu.
Problem solver and Data recovery specialist. Usually share informative articles on data recovery, database corruption and ways to recover lost data.
View More. Your email address will not be published. Time limit is exhausted. Check the hard drive health. If the utility displays SMART warning or any health or performance-related warning signs, immediately clone the disk Disk cloning is important as any further rigorous data recovery scan and actions can cause drive failure, leading to permanent data loss. The selected recovered files and folders will be saved at your desired location Now that you have access to your lost data from broken or crashed Synology RAID, format each drive to construct RAID from scratch.