Board logo

標題: [操作疑難] NAS 被炸... [打印本頁]
作者: t1174-3    時間: 2022-10-28 13:06     標題: NAS 被炸...

NAS 被炸, 不停咁收到ROUTER中的防毒SEND EMAIL 來, 說 NAS 比人"External Attacks". 其中大多數只是來自一個 IP :         146.148.19.35. 咁因為 ROUTER BLOCK 了, NAS 是沒事. 不過就不咁收到ROUTER EMAIL, 只有暫時關了個 e-mail 通知. 不過就又一同冇了其他通知了.

個 ATTACK 說明是關係 CVE-2021-44228, GOOGLE了 SYNO 官方說 NAS 沒有中的.
ROUTER FIREWALL SET 了BLOCK         146.148.19.35, 不過不知是 SET 錯 OR ROUTER中的防毒比 FIREWALL 先, 不關 e-mail 通知 還是不停來.

有乜其他方法?
作者: 觀星是答案    時間: 2022-10-28 13:59

知你有隻 NAS 係公海裸泳 , 一定會黎搞你的
作者: t9097    時間: 2022-10-28 14:14

提示: 作者被禁止或刪除 內容自動屏蔽
作者: 炎冬    時間: 2022-10-28 14:49

NAS 被炸, 不停咁收到ROUTER中的防毒SEND EMAIL 來, 說 NAS 比人"External Attacks". 其中大多數只是來自一 ...
t1174-3 發表於 2022-10-28 13:06



    關了web server就沒事啦~~https://www.nccst.nat.gov.tw/VulnerabilityDetail?seq=1194
作者: t1174-3    時間: 2022-10-29 00:29

有web host 住呢，雖然不是port 80. 睇嚟只有忍
作者: s84292    時間: 2022-10-29 20:12

NAS 被炸, 不停咁收到ROUTER中的防毒SEND EMAIL 來, 說 NAS 比人"External Attacks". 其中大多數只是來自一 ...
t1174-3 發表於 2022-10-28 13:06


你隻NAS上層隻ROUTER 有冇IPS防禦功能

ROUTER冇得獨立SET 呢類event 唔通知? 咩牌子
作者: t1174-3    時間: 2022-11-2 16:14

ASUS ROUTER 之嘛, 好普通, 就是 ROUTER SEND E_MAIL 來說的 NAS 比人打的, 就是不見到可以 SET 獨立一個 EVENT  唔通知, 只可以一SET EVEN  唔通知. 不過現在好像打完.
作者: jerrychan0610    時間: 2022-11-3 10:40

本帖最後由 jerrychan0610 於 2022-11-3 10:54 編輯
知你有隻 NAS 係公海裸泳 , 一定會黎搞你的
觀星是答案 發表於 2022-10-28 13:59



   我隻NAS無放出嚟都不停比人炸..
睇個ROUTER LOG, 不停 ROOT, ADIN, ....TELNET入.
同一個模式, 但不同IP過嚟.
  1. 10:34:32 system,error,critical login failure for user root from 95.245.182.85 via telnet
  2. 10:34:33 system,error,critical login failure for user root from 95.245.182.85 via telnet
  3. 10:34:37 system,error,critical login failure for user root from 95.245.182.85 via telnet
  4. 10:34:39 system,error,critical login failure for user root from 95.245.182.85 via telnet
  5. 10:34:41 system,error,critical login failure for user Admin from 95.245.182.85 via telnet
  6. 10:34:45 system,error,critical login failure for user root from 95.245.182.85 via telnet
  7. 10:34:46 system,error,critical login failure for user root from 95.245.182.85 via telnet
  8. 10:34:48 system,error,critical login failure for user root from 95.245.182.85 via telnet
  9. 10:34:52 system,error,critical login failure for user root from 95.245.182.85 via telnet
  10. 10:34:54 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  11. 10:34:55 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  12. 10:34:59 system,error,critical login failure for user root from 95.245.182.85 via telnet
  13. 10:35:01 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  14. 10:35:03 system,error,critical login failure for user root from 95.245.182.85 via telnet
  15. 10:35:07 system,error,critical login failure for user root from 95.245.182.85 via telnet
  16. 10:35:09 system,error,critical login failure for user 666666 from 95.245.182.85 via telnet
  17. 10:35:10 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  18. 10:35:15 system,error,critical login failure for user Administrator from 95.245.182.85 via telnet
  19. 10:35:16 system,error,critical login failure for user root from 95.245.182.85 via telnet
  20. 10:35:18 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  21. 10:35:22 system,error,critical login failure for user root from 95.245.182.85 via telnet
  22. 10:35:24 system,error,critical login failure for user root from 95.245.182.85 via telnet
  23. 10:35:25 system,error,critical login failure for user root from 95.245.182.85 via telnet
  24. 10:35:29 system,error,critical login failure for user guest from 95.245.182.85 via telnet
  25. 10:35:31 system,error,critical login failure for user root from 95.245.182.85 via telnet
  26. 10:35:32 system,error,critical login failure for user root from 95.245.182.85 via telnet
  27. 10:35:37 system,error,critical login failure for user root from 95.245.182.85 via telnet
  28. 10:35:38 system,error,critical login failure for user root from 95.245.182.85 via telnet
  29. 10:35:40 system,error,critical login failure for user root from 95.245.182.85 via telnet
  30. 10:35:44 system,error,critical login failure for user root from 95.245.182.85 via telnet
  31. 10:35:45 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  32. 10:35:47 system,error,critical login failure for user mother from 95.245.182.85 via telnet
  33. 10:35:51 system,error,critical login failure for user root from 95.245.182.85 via telnet
  34. 10:35:53 system,error,critical login failure for user root from 95.245.182.85 via telnet
  35. 10:35:54 system,error,critical login failure for user ubnt from 95.245.182.85 via telnet
  36. 10:35:58 system,error,critical login failure for user supervisor from 95.245.182.85 via telnet
  37. 10:36:00 system,error,critical login failure for user admin1 from 95.245.182.85 via telnet
  38. 10:36:02 system,error,critical login failure for user service from 95.245.182.85 via telnet
  39. 10:36:06 system,error,critical login failure for user support from 95.245.182.85 via telnet
  40. 10:36:07 system,error,critical login failure for user root from 95.245.182.85 via telnet
  41. 10:36:09 system,error,critical login failure for user root from 95.245.182.85 via telnet
  42. 10:36:13 system,error,critical login failure for user supervisor from 95.245.182.85 via telnet
  43. 10:36:15 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  44. 10:36:16 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  45. 10:36:20 system,error,critical login failure for user root from 95.245.182.85 via telnet
  46. 10:36:22 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  47. 10:36:24 system,error,critical login failure for user root from 95.245.182.85 via telnet
  48. 10:36:28 system,error,critical login failure for user root from 95.245.182.85 via telnet
  49. 10:36:29 system,error,critical login failure for user root from 95.245.182.85 via telnet
  50. 10:36:31 system,error,critical login failure for user root from 95.245.182.85 via telnet
  51. 10:36:35 system,error,critical login failure for user tech from 95.245.182.85 via telnet
  52. 10:36:37 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  53. 10:36:38 system,error,critical login failure for user root from 95.245.182.85 via telnet
  54. 10:36:42 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  55. 10:36:44 system,error,critical login failure for user administrator from 95.245.182.85 via telnet
  56. 10:36:45 system,error,critical login failure for user root from 95.245.182.85 via telnet
  57. 10:36:49 system,error,critical login failure for user root from 95.245.182.85 via telnet
  58. 10:36:51 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  59. 10:36:53 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  60. 10:36:57 system,error,critical login failure for user guest from 95.245.182.85 via telnet
  61. 10:36:59 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  62. 10:37:01 system,error,critical login failure for user root from 95.245.182.85 via telnet
  63. 10:37:05 system,error,critical login failure for user root from 95.245.182.85 via telnet
  64. 10:37:06 system,error,critical login failure for user root from 95.245.182.85 via telnet
  65. 10:37:08 system,error,critical login failure for user root from 95.245.182.85 via telnet
  66. 10:37:12 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  67. 10:37:14 system,error,critical login failure for user root from 95.245.182.85 via telnet
  68. 10:37:15 system,error,critical login failure for user admin from 95.245.182.85 via telnet
  69. 10:37:19 system,error,critical login failure for user root from 95.245.182.85 via telnet
  70. 10:37:21 system,error,critical login failure for user root from 95.245.182.85 via telnet
  71. 10:37:23 system,error,critical login failure for user root from 95.245.182.85 via telnet
複製代碼
作者: 觀星是答案    時間: 2022-11-3 10:44

我隻NAS無放出嚟都不停比人炸..
睇個ROUTER LOG, 不停 ROOT, ADIN, ....TELNET入.
同一個模式, 但不 ...
jerrychan0610 發表於 2022-11-3 10:40

無放隻 NAS 出黎 , 但又想 Telnet 入 , 即係你放左隻 router 個 remote access , d 人係想撞你隻 router ?
作者: jerrychan0610    時間: 2022-11-3 10:56

無放隻 NAS 出黎 , 但又想 Telnet 入 , 即係你放左隻 router 個 remote access , d 人係想撞你隻 router ? ...
觀星是答案 發表於 2022-11-3 10:44

其實你放唔放PORT出海, 都會被撞.
作者: 觀星是答案    時間: 2022-11-3 11:10

其實你放唔放PORT出海, 都會被撞.
jerrychan0610 發表於 2022-11-3 10:56

撞 Port 22 係 keep 住有 , 但如果發現 Port 5000 / 5001 都有反應 , 就會撞埋
你無開個 port 22 咪由佢撞 , 撞中都唔會有反應

之前有好多對外放左 5000/5001 既 syno 就係咁中晒招變左彊屍機
作者: cheryl12    時間: 2022-11-3 21:49

提示: 作者被禁止或刪除 內容自動屏蔽
作者: 小小米    時間: 2022-11-5 12:59

撞 Port 22 係 keep 住有 , 但如果發現 Port 5000 / 5001 都有反應 , 就會撞埋
你無開個 port 22 咪由佢撞 ...
觀星是答案 發表於 2022-11-3 11:10



    之前有好多對外放左 5000/5001 既 syno 就係咁中晒招變左彊屍機 ......

S記,會變左彊屍機???? 咁種左會點?
作者: 觀星是答案    時間: 2022-11-5 13:42

之前有好多對外放左 5000/5001 既 syno 就係咁中晒招變左彊屍機 ......

S記,會變左彊屍機???? 咁 ...
小小米 發表於 2022-11-5 12:59

被偷資料 + 被控制 + 你部 NAS 會幫手一齊撞其他人既 NAS
作者: t1174-3    時間: 2022-11-5 15:48

說起來, 個 LOG 沒有說是乜 PORT 呢. 反正NAS ADMIN PORT 本身就沒有出街, 只有 WEB 等THOUGH NAS 的一個 PROXY 出.
作者: hoktong    時間: 2022-11-5 19:08

我一直都係用 80/443 代替 5000/5001 年幾都只係試過兩個人試撞 password 然後被 block




歡迎光臨 電腦領域 HKEPC Hardware (https://www.hkepc.com/forum/) Powered by Discuz! 7.2