Definitely not going to argue with you there, you are spot on. My big point was only that QNAP has moved to a more aggressive posture and the advice given could have and likely would have prevented the second round of attacks.P3R wrote: ↑Mon Apr 11, 2022 8:20 amUnfortunately it wasn't strong and that was my problem with it.
In the April 22, 2021 Security News named Response to Qlocker Ransomware Attacks they said that people should install Malware Remover, use strong passwords, keep their systems updated, avoid using standard ports and do backups. Do you find anything strong there? I find it ridiculous as a response to a huge ransomware attack affecting thousands of users.
The January 7th, 2022 statement is strong and more importantly, it wasn't disambiguous.
Unfortunately Qnap still have things like the schizophrenic and embarrasing security best practice page (last edited in March 2022) up.
Items 3 and 4 are actually the same message as is given in the January 7th statement. They say that people should stop using the Auto Router Configuration (UPnP) and stop exposing the system directly on the Internet but use myQNAPcloud Link or QVPN. Except for that I don't agree with the advice of using QVPN due to the awful breakins then had in it in December 2021, I think those are excellent advice.
The huge contradiction starts in item 5 though where they suddenly have forgotten all about what they wrote in items 3 and 4 so there they say "Change the System Port Number if NAS is directed connected to the Internet.".
You can't both take your NAS off the Internet and still expose it (even if they recommend a non default port)!
But ya, they still have a long way to go with embracing and messaging a real security posture for their devices.