Ransomware Protection: The Complete Guide for Synology NAS

Рет қаралды 81,099

Күн бұрын

In this video, I will be covering what ransomware is and how to protect your NAS. I go over some simple steps that pretty much everyone should take to prevent a ransomware attack, as well as some measures to make sure your data is safe even if an attack occurs.
Hire Me! www.spacerex.co/hire-me/?utm_...
Post on the Forums! forums.spacerex.co/
Related Tutorials:
Snapshot Guide: • The COMPLETE BTRFS Sna...
DSM 7.2 immutable snapshots (16 min mark): • TOP 6 Updates for Home...
Is Quick Connect Secure?: • is Quick Connect Secur...
Hyperbackup guide: • The Complete Hyper Bac...
Synology Recommendations*:
Hard drives I recommend: amzn.to/3RA3udS
Starter NAS with BTRFS: amzn.to/46hrRS7
Great all around NAS with BTRFS: amzn.to/46egNVP
More powerful NAS with BTRFS (great for larger/mid sized businesses): amzn.to/3YwRziM
#synology #nas #ransomware
TOC:
00:00 Introduction
00:23 What is ransomware?
03:05 Hardware requirements
04:35 Basic security settings
07:58 User & Group settings
10:42 File Access settings (including SMB)
13:26 External Access settings (Quick Connect and UPnP)
15:42 Which ports do you have open?
22:55 Recovering from ransomeware with snapshot replication
26:55 Snapshot setup walkthrough
33:48 Restoring from snapshots after a ransomware attack
36:54 Conclusion
*These are affiliate links, which means that if you purchase a product through one of them, I will receive a small commission (at no additional cost to you). Thank you for supporting my channel!

Пікірлер: 120

@ScottTempletonX 7 ай бұрын

I had 1 Synology NAS for about 8 years and I've had my upgraded one for about 3 years. I'm that guy who knows enough to get things working, but likely just barely, and with several (unknown to me) security holes. In the past week I've decided to dig in, learn more, and harden the security and functionality of my system. I've mostly done this with the help of your fantastic videos. You are a great teacher. Thank you sincerely! Cheers

@SpaceRexWill 7 ай бұрын

Thanks so much!

@randomnaamofzo1246 9 ай бұрын

Subbed! I love that concerned face of him while explaining stuff thoroughly and with good quality.

@spacemanwho 6 ай бұрын

Man love your videos. I also love the fact your giving your insights and thoughts on things. It really helps put things to perspective. Thanks dude.

@jlimozin 9 ай бұрын

Thank you, great tutorial. I am setup pretty much exactly as you described and I thought I knew my stuff, however I still learned a couple things from you!

@robertoghinato5754 8 ай бұрын

Fantastic job Will!! This was a well explained yet clear explanation! Salute from Italy

@jays9591 4 ай бұрын

I bought my DS216+II in 2018. As a non-tech person, I was glad that I managed to set things up and used my NAS as a backup using Synology Drive. However, I really did not know what I was doing. All those years, I did not have the NAS security set up properly as you explain here. Thank you for your video. It's really helpful.

@dobrzpe 4 ай бұрын

wow - your explanation of snapshots was AMAZING! thanks!

@mar4kl 9 ай бұрын

Timely! I'm in the process of replacing a client's aging QNAP NAS with a Synology model. (I have a lot more experience with QNAP, but went with Synology this time because I'm uncomfortable with how many times QNAP has been successfully targeted by ransomware criminals in the past few years and not impressed with the alacrity of their responses nor with how seriously they took each incident. Taking a pass on QNAP for awhile.) Your videos have been a great help to me, but this one is a real treasure trove! I'm implementing each and every thing you recommended. You've earned yourself a new member, my friend!

@SpaceRexWill 9 ай бұрын

Thank you so much man!

@Chewbucksa 8 ай бұрын

I've learned so much from your videos. Thank you for the hours of work!

@PowerUsr1 8 ай бұрын

Good job on this video. Common sense approaches anyone can take to secure their files. Synology is king for not putting any of these features behind a paywall. Lets give them praise!

@brianhansen6906 9 ай бұрын

Love the info! Snapshots saved me once when I accidentally overwrote some files. I was easily able to back and retrieve them. Snapshots is one of the coolest features ever.

@SpaceRexWill 9 ай бұрын

yeah! Snapshots are game changers! They absolutely can easily save you

@burkec33 9 ай бұрын

Great segment! Thanks for the perspective for different types of users.

@XiterPL 9 ай бұрын

As usual, great video!

@maxbarko8717 9 ай бұрын

Thank you for this very important tutorial! I have set my hyperbackup external device to be ejected after the backup. Just to make sure that there is no access in case of an attack. I also unplug it. I always wanted to suggest to zoom your screencasts to maximize the window you are showing.

@richardturkson5916 9 ай бұрын

Bravo! Great presentation. This is very helpful.

@DuhRake 9 ай бұрын

Thank you so much for this video, that was a lot of great information!

@shenghuli8502 5 ай бұрын

Really practical tips, especially for new users of NAS🎉🎉🎉

@colepascua 3 ай бұрын

I really learn a lot from you and your channel. Thank you so much for your videos!!

@theanalogkid4171 9 ай бұрын

Great info Rex, really appreciate it !!

@SpaceRexWill 9 ай бұрын

Glad it was helpful!

@6gengineering 4 ай бұрын

thanks for making this video much appreciated it has helped me removing the security risk and getting my head around this NAS system i have. i have to say i hate the fekn thing its way to complex and massively expensive for just storing files on as a replacement to two desktop hard drives mirrored by chronosync only upside i see is you can access it from anywhere.

@a415man 8 ай бұрын

Sooo helpful thanks. Still running DSM 7.1 after the drama of 7.2 - so not everything matches up, but still great. Still debating on making the jump to 7.2 - but your other vid makes it sound more stable now.....

@Dreamtwister2k 6 ай бұрын

I'm late to this video but the information was incredibly useful and I'm glad to have stumbled upon it.

@Mohandas.Gandhi 3 ай бұрын

Thank you for making this video, this is exactly what I needed

@Dudenessvideo 4 ай бұрын

Really great video! Thanks!

@Urbanmediashowcase 6 ай бұрын

Your videos are very informative. Thank you.

@ckckck12 2 ай бұрын

Picked up a couple good ideas here. Thank you!

@Robby520 6 ай бұрын

Much appreciated guide. Really helpful.

@41-4E-4F-4E 9 ай бұрын

Reassuring to know it’s all “common sense” stuff and I’m well protected. Enjoyed the video, thanks for sharing.

@ButchHammer 9 ай бұрын

Thank you for your series 😇

@amirhemmati3771 7 ай бұрын

Great presentation. Thank you.

@republicoftexas3261 4 ай бұрын

Never knew about this. Awesome

@marquessouzamarques 5 ай бұрын

thanks, great video , thanks from Brazil

@viviansprivatekitchen1437 4 ай бұрын

Great video!

@wesc6755 9 ай бұрын

Good advice. Snapshots are great. I wish there were a solution that would allow more granularity for the /homes snapshot though. Snapshots work only at the shared folder level, so users can't self-admin restores for their particular /homes/username folder. Drive Client has previous versions, but still... I enjoy it when people don't bug me. :)

@francoiss2100 8 ай бұрын

Crazy good video!!

@timroach5898 6 ай бұрын

Love it thank you from a new Synology owner. I hope windows will some day support BTRFS file system as a default option.

@waterbourne9282 5 ай бұрын

Excellent, thanks.

@czummo76 9 ай бұрын

Great info, you convinced me to use snapshots even though my NAS backs up my file server, i see the advantages of using snapshots. Too bad syno doesn't describe the use more in depth in their Package Center or more people would be using this tool

@SpaceRexWill 9 ай бұрын

I actually wish that snapshots would be a default install pop up like drive is now. But they are a bit complicate to setup at first

@DrJosephSweeney 5 ай бұрын

In our firm, see a lot of our clients that have been hit with ransomware. One of the key areas the cybercriminals target is the backups. So it's vital to protect the backup as well, and snapshots are the bomb for this. I run one NAS with snapshots and MFA required for all access, and all those protection settings, plus it is not available to internet. Then I have an occasionally connected NAS that backs up the primary. Yep. I'm paranoid. It's not a matter of being a "high priority" target for hackers. They run scripts to automatically hunt for "easy targets." You really, really don't want to be an easy target.

@DrJosephSweeney 5 ай бұрын

Excellent video. Super-impressed you commented on SMB1!

@nicoscherer9427 9 ай бұрын

Hi, nice basic tutorial! For the part on port-forwarding: You could have added information about implemented VPN or e.g. Tailscale VPN (available in Synology packages) and Firewall rules that allow all ports via these services and blocking all others, so that there is no need to open any more ports than for the VPN service (in case of Synology implemented VPN used), or allow Tailscale subnet (in case of Tailscale service used). Nonetheless. Thank You! :)

@alfylorenzo5095 4 ай бұрын

thank you so much for this video, Soooooooooo Helpful WOW!

@photojasinski 9 ай бұрын

I just received my 923+ but was reluctant to even open it to due to its complexity. This video is proving to be hugely helpful and give confidence about this purchase! Question for you: my main purpose of getting Synology is to store/access my huge library of RAW + JPG image files as a photographer. The appeal of the NAS was also to access photos from anywhere in the world since I travel for work a lot. Currently I have 12TB's worth of photos on a G-DRIVE external HD which desperately needs to be backed up (and expand). I purchased 3x IronWolf Pro 12TB drives and I'm not sure if I should set it up as SHR or RAID 5? I bought the 3rd drive with the intention of doing RAID 5 however seeing SHR as an option I could return the 3rd drive to save some money as I likely will be ok with 24TB for now. Once the NAS is all setup I plan to backup everything onto Backblaze and/or those old HDD's. All that being said, in my case what do you recommend?

@tiberone5957 8 ай бұрын

Under the hood, SHR utilizes RAID technology. The benefit is the ability to later on expand the array without having to completely delete it. No reason to not use SHR over RAID as SHR is a lot more user friendly.

@aktiveXkontrol_gaming 3 ай бұрын

Big thanks mate

@snoopywalker1881 5 ай бұрын

Great Video again Rex. Didn't know about Upnp, which was on . Now off

@JoeyTrotz 9 ай бұрын

Thanks for the video. Your channel convinced me to switch to Synology from QNAP. One question - is having rsync (port 22) open for off-site backup a concern?

@klauschneider 9 ай бұрын

Thank you

@BhargavGajjar7 9 ай бұрын

Can you please make a video about upgrading/replacing HDD Drives on two bay Synonoly NAS system with out loosing data? Thanks!!!

@Techboilerplate 6 ай бұрын

One important suggestion before restoring a snapshot. Make sure you identify the computer that got the ransomeware virus and disconnect it from the network or else after you restore the snapshot your company files will just get encrypted again!!! You will want to reimage the computer before connecting it back to the network. I battled many cryptolocker ransomeware and was able to restore with snapshots and was able to get customer back working in a couple hours. Was a true feeling of having a superpower!!!!

@VoteRepublicanSaveAmerica 8 ай бұрын

Thanks for the VIDS They are GREAT and VERY Informative! I do have some questions: I have a Synology NAS 1821+ As I understand it, if I don't have SMB "ON" then I can not use File Explore to access my file via my inTRAnet. Currently, my port is open because I want to just add the folders to my explore as to logging into the dashboard. Is there a difference in the SMB? So right now the only open port is 443 (maybe I should not be posting that but...) I get MANY!, " IP address ***.***.*.* has been blocked by NAS VIA SMB." I have gotten as many as 25 a day. I add these IP addresses to my routers "Block sites containing these keywords or domains" I am not sure if that does me any good except making me feel better. How do I stop the attacks? Thanks

@garydeluce464 9 ай бұрын

Just a word on the NTLMv1 auth. It's not that it can be easily bruteforced, it's that it's a weak hash and is trivial to crack. It's also very trivial to "pass" the hash to the NAS or another target.

@running4fun74 7 ай бұрын

Spacerex, I've used GRC's Shields Up to check open ports. Do you have any thoughts on them? Also curious, when checking for open ports does is it per computer or router?

@andrewbradley2963 9 ай бұрын

Thank you very much for this, it has been most informative and helpful. I wonder if I could ask a question about snapshots though, my nas is approximately 15TB in size, with around 10TB of files on there at any time. If I install snapshots and get hit by a ransomware attack that encrypts all 10TB of files, how would the snapshot be able to cope as each of the 10tb of files would be locked, but there isn't enough space for it to keep the older version of the file as they are rewritten/encrypted? I know you mentioned that this is complex and hard for some people to get their heads around (I guess I am one of those people) - but would snapshots save me in this instance?

@osphere 8 ай бұрын

As the ransomware would be encrypting each file, the file system stores the delta between the original and the new version. In your scenario, when the drive reaches 100% (consisting of your original data + a full new version of each file, generated by the ransomware) - there won't be any space left, so the malware won't be able to 'save' the file (in its encrypted form) because the disk will be full which stops the change to the file.

@devrimers 8 ай бұрын

hello, thanks for the video. I have a question: I have 4 disk total space 8TB with RAID 10 as volume1. and I have 1 disk 8TB as volume2. all my shared folder in volume1. and I want to use that snapshot replication to take all my files in volume1 and save them in volume2. is that possible ? I mean snapshot can use my volume2 for data store ?

@jonicolton 8 ай бұрын

thank u. 🤟🏼

@Emulives 9 ай бұрын

What is the "normal" speed to transfer files to USB drive backup using Hyperbackup? I'm getting transfer rate of 100kbps sometimes. Not even 1mbps. This during the day when I' using. But is not fast either when the Nas is not in use.

@JacobP81 5 ай бұрын

Thanks. I am also wondering about the best way to give access to a folder on the Internet so I can backup and access pictures remotely without giving additional access to my NAS.

@johanarens9798 2 ай бұрын

If you open SSH, change the default port to something else, bots are scanning TCP/22 and will try to connect, trying brute forcing the login. By changing the default, you would decreasing this behaviour by far.

@ellenorbjornsdottir1166 9 ай бұрын

So, transferring to a PC running FreeBSD - I should use ZFS and practice good snapshot hygiene?

@shubinternet 9 ай бұрын

You've got a good basic security tutorial here that I think could be expanded and split into a separate video. Then you could spend more time in this video that focuses on just the snapshot and replication stuff.

@arnoldleonard886 9 ай бұрын

How might regular snapshots and immutable snapshots affect the amount of data being backed up to a remote service such as Backblaze? I want to setup a remote backup service, but I am unsure about what should be remotely backed up, how to designate only those important files/folders, and how to estimate the total size (and thereby cost) of my backup.

@SpaceRexWill 9 ай бұрын

They will have no effect on the remote backup. Cloud sync and hyperbackup do not backup snapshots, only the active file system

@EuroPC4711 9 ай бұрын

Thanks for your helpful videos! Does it make sense to use snapshots on my off- site hyper backup NAS?

@SpaceRexWill 9 ай бұрын

I will do a pretty non aggressive snapshot policy of 1x per week, and keeping 4x weekly versions of the hyperbackup folder, assuming there is space. This would allow the main NAS to be completely hacked, and delete its own backup, but still be able to recover from it

@EuroPC4711 9 ай бұрын

@@SpaceRexWill thanks Will!

@byrd203 8 ай бұрын

Remote Desktop can be used as long you don’t use the default port and setup secure connections only i picked a port on my router that’s drcure to use plus i have software to block RDP connections unless they go through that port and not on that ban list and drop list

@alextralha6318 8 ай бұрын

So I just ordered a DS223j. Looks like it is Btrfs based on specs?

@danielwilder7835 9 ай бұрын

if i mapped a drive/folder from my synology on my windows would that give a hacker or exe program easier access?

@mrcjay 6 ай бұрын

Can you please make an video from active insight Ransomware Protection.

@gobofraggel7383 7 ай бұрын

It's great but not truly immutable if anyone who can log in is able to turn it off and wait a few weeks before encrypting the data. The key is making it impossible to disable immutability remotely and having a physical button on the NAS that must be pressed before immutability can be disabled or altered in any way. It could then allow a window of 5 or 10 minutes before the settings are locked again. I currently have something like this on a much more expensive enterprise system that requires myself and someone else (2 people) to provide support with a secret pin via a zoom call before the lock-down mode is disabled, allowing me to make changes to immutability settings. Any system can be compromised, requiring some sort of physical access to make changes is the key to protection against ransomware.

@notreallyme425 9 ай бұрын

Is it possible to setup a user account such that the administrator account(s) cannot see the user’s files in the user account’s home folder?

@SpaceRexWill 9 ай бұрын

There is not.

@chicodeme 8 ай бұрын

Time machine requires AFP to be on. If you turn that off, you will get "The selected network backup disk does not support the required capabilities. Please be sure Time Machine capabilities are enabled on the server for this volume or choose a different network backup volume.". Thanks for the tips.

@SpaceRexWill 8 ай бұрын

So this can be a glitch. You can use SMB with time machine and should! You want to just make sure you have a few SMB settings enabled, I have a video on it

@chicodeme 8 ай бұрын

Thanks. Let me go try that@@SpaceRexWill

@chicodeme 8 ай бұрын

Yup worked. Ty! @goat ... deets in video "How to Backup MacOS to Synology NAS using Time Machine"

@danielchien7274 9 ай бұрын

This is a simply way to stop all ransomware new or old. Just won't let it to run. You can use a library/folder based whitelist that has all authorized programs/scripts can be run safely. This whitelist can only be modified in safe mode. So, hackers or disgruntled employee can't run any unauthorized programs/scripts.

@XarlioG60 8 ай бұрын

The inconvenient that I see with Snapshot Replication it not have folder excluding. For example, I have a shared folder that I want to replicate, but one of the folders inside that shared folder contains a LOT of videos, with a total of 9TB inside that shared folder and I don't want to replicate all of that. The only way I know is to make a new directories hierarchy. Is there any other solution?

@SpaceRexWill 8 ай бұрын

So the way snapshots work is they are file unaware, they actually send the underlying volume over, rather than files (it’s what makes them so fast and safe) Otherwise you could use something like Synology drive share sync.

@tonyvalenti6614 4 ай бұрын

How about port forwarding for Plex? I that safe?

@felipeoliveira895 8 ай бұрын

I have a question about the snapshot mechanism. How is it possible that the malware damages other files but not the snapshots themselves?

@SpaceRexWill 8 ай бұрын

Because malware is interacting on the file system level, but the snapshots are actually a level lower than that, so malware cannot directly interact with them

@felipeoliveira895 8 ай бұрын

@@SpaceRexWill Does it mean the snapshot cannot be stored in the same volume? Or is the same volume but somewhere else outside shared folders?

@gat1986 5 ай бұрын

I can't find MFA on DSM 6?

@spaaske 5 ай бұрын

Why is under Protection > Autoblock your 'enable block expiration' off? If for some reason you fail after 10 attempts, can't you lock yourself out of your Synology?

@SpaceRexWill 5 ай бұрын

But you can always just go from a different IP address

@Balan_E 8 ай бұрын

Hi Nas delete file how to recover pls video upload it.

@JavierSN95 8 ай бұрын

i have express vpn, and i have it connected to my nas, is that safe?

@patzfan8086 5 ай бұрын

I love your videos, But your personality doesn't match mine. But i always try and come back. Hopefully, this helps your algorithm.

@RyderCragie 6 ай бұрын

Immutable snapshots aren’t available on all NAS’s.

@yesmanhk 9 ай бұрын

just dont buy qnap and you will be safe for 50%

@jeffreyooi1971 9 ай бұрын

New ransomware now will totally wipe out your Synology NAS. So even if you have snapshots there is no use.

@SpaceRexWill 9 ай бұрын

What new ransomware are you talking about?

@jeffreyooi1971 9 ай бұрын

@@SpaceRexWill I can't remembered what it called but my customer got their Synology NAS totally wipe out during the ransomware attacked in Q1 this year. They did have snapshots configured but no use. All theirs data is gone. If they have backup an off-site copy that would be much easier to restore, too bad they don't have.

@michelbedard8406 4 ай бұрын

In 2024, why don't you just sync all your files with OneDrive or Dropbox ? That is a real question.

@lauren301 9 ай бұрын

I enjoy your videos but please don’t ramble so much. Please deal more with just you topic. Thanks and keep up the good work.

@theanalogkid4171 9 ай бұрын

He's providing professional technical advise for FREE and you're complaining? Wow, just wow.

@bigpickles 9 ай бұрын

I've watched since day one and prefer the longer form. He's a joy to listen to. Horses for courses, young padawan.

@marklee6538 9 ай бұрын

Nah man, that "rambling" has provided me small details I have looked for and not found else where. I am happy the way he does it, many times I have been trying to figure out 1 setting and he has hit on it, when no one else has.

@MikeFox1 9 ай бұрын

Will, don't change a thing! Your videos are incredibly useful to me and very well done.

@robertoghinato5754 8 ай бұрын

bruh are you high he's doing great job and totally free!!