{"id":20030,"date":"2022-09-06T16:10:05","date_gmt":"2022-09-07T00:10:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/09\/06\/news-13763\/"},"modified":"2022-09-06T16:10:05","modified_gmt":"2022-09-07T00:10:05","slug":"news-13763","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/09\/06\/news-13763\/","title":{"rendered":"Update now! QNAP warns users DeadBolt is exploiting Photo Station vulnerability"},"content":{"rendered":"

QNAP (Quality Network Appliance Provider) has warned users<\/a> to update Photo Station to the latest available version.<\/p>\n

The warning comes after QNAP detected that cybercriminals known as DeadBolt have been exploiting a Photo Station vulnerability in order to encrypt QNAP NAS systems that are directly connected to the internet.<\/p>\n

QNAP produces NAS (Network Attached Storage) devices, among other things. QNAP’s Photo Station is an online photo album that allows users to share photos and videos stored on their NAS with others over the internet. With Photo Station, users can drag and drop photos into virtual albums, which means they don’t have to create copies when they are needed in more than one album.<\/p>\n

Deadbolt<\/h2>\n

The ransomware group responsible for this attack is generally known as DeadBolt. The name DeadBolt is also used in the file extension of the encrypted files that the group’s ransomware generates.<\/p>\n

QNAP and DeadBolt have history. In January 2022, news broke that a ransomware group was targeting QNAP Network Attached Storage (NAS) devices. As a countermeasure, QNAP pushed out an automatic, forced, update<\/a> with firmware containing the latest security updates to protect against the attackers’ DeadBolt ransomware, which annoyed part of its userbase.<\/p>\n

The vulnerability<\/h2>\n

Little has been published about the vulnerability, except that the QNAP Product Security Incident Response Team (QNAP PSIRT) made the assessment and released the patched Photo Station app for the current version within 12 hours. All that was made clear is that the ransomware gang is exploiting a Photo Station vulnerability to encrypt QNAP NAS systems that are directly connected to the internet.<\/p>\n

The vulnerability has been fixed in the following versions:<\/p>\n