On the wicked WAN

[ColHut]

I was wondering about the real risk (which is real) of port forwarding.

I consider just how many holes have already been punched through the router for various games onto the several PCs hanging off it. I wondered how much risk there was from that alone?

And whilst I might consider to some extent the individual PCs to be expendable (they are all backed up locally and remotely). Don’t they represent a risk because they are on the LAN , and so malware could strike through them to the the LAN to my NAS and other PCs?

Likewise if I download malware by mistake, or browse some evil, possibly hacked website, these all could bring the problem behind the router and into the LAN anyway?

So whilst I am dedicated to getting all of my remote connections off MyQnapCloud and onto at least a NAS based VPN, I am wondering if this is not all a bit futile? Heck that very remote resource is on a real local LAN too.

I am trying to get some perspective here, and I have no way of really calculating risk.

Regards.

[dolbyman]

look at this forum, reddit, bleeping computer

All the people that have lost their data...what percentage is this of people exposing thier NAS?...unknown...but do you want to risk it?

[ColHut]

Thanks I do check the Reddits etc. It does concern me. I just wonder how all the other vulnerabilities compare…

[jaysona]

Port forwarding itself is not really the issue. What is being made accessible via the port forward is the issue.

QNAP NAS malware will not infect a Windows, MacOS, Linux, etc workstation, just as a Windows malware will not infect a MacOS workstation - yet. I suspect that one day, sooner than later, there will be malware that will be able to re-write itself to exploit whichever systems the infected host has access to.

That said, no one should be forwarding any ports from the internet to internal systems unless they know what they are doing and have a sufficient level of technical knowledge.

The inverse is also true, all systems should have no default route to the Internet and all outbound access would be sent via a proxy server. Of course this is technically complex for the uninitiated, which is why most do not employ these measures.

In an ideal setting none of these settings would be necessary, however this will not change until there are legal consequences for producing insecure software.

Luckily our physical infrastructure are not designed, engineered and built the way our digital infrastructure is - otherwise we would need a lot more cemeteries.