Synology warns NAS owners to update now as ransomware targets old DSM versions

[DeepHandset]

If you own a Synology NAS, now is the time to check for updates. TechRadar reports that Synology has warned of ongoing attacks against NAS devices running outdated versions of its DSM operating system

Synology said threat actors are exploiting a vulnerability that was patched in December 2024. The flaws are CVE-2024-10441, which allows code execution, CVE-2024-50629, which allows file reading, and CVE-2024-10445, which allows file writing. They are rated critical on every version except 6.2, where they are moderate

The fixed versions are DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 and 6.2.4-25556-8 or later. Shadowserver tracks around 380,000 internet facing Synology devices, although how many are vulnerable is unknown

The advice is to update immediately, turn on automatic updates, and remove the NAS from the open internet or restrict access to it. RAID and built in backups may not protect you if the device itself is encrypted, so a separate offline backup is wise

The patches have been available for nearly two years, which shows how many people never update their home storage devices. A NAS often holds family photos and important documents, so the stakes are high. Five minutes checking for updates could save a lot of heartache

Do you keep your NAS or router updated? And do you have an offline backup of your important files?

Synology NAS devices could be under attack from new ransomware threat - so update nowwww.techradar.com

[Perigee Jaguar]

Following the 3-2-1 backup rule is still the best advice. Three copies, two types of storage, one off site

Cloud backup is cheap now. Offline drives in a drawer are the safest backup. Ransomware cannot reach them. Old school works