Successful logins by users that dont exist

[Skwor]

Those threads and the other posts in this thread deal with the many vulnerabilities of QTS. I get that. I got that before I started this thread. I know what I'm dealing with and I take the risks I want to take and that I find acceptable in relation to the importance of what I have on my NAS. I'm not a n00b throwing my vital data in the hands of hackers without caution or backup.

So if we can put that aside along with the dripping sarcasm then what I'm still looking for is an actual answer to my actual question. How can users that don't exist on my NAS show up as having successfully logged on my NAS? I showed a screenshot that also shows that those users did not actually seem to use/access any resources on my NAS. Compromized or not, I would assume that for a user called "Alex" to successfully log on to my NAS, that user should actually be existing on my NAS, yet that seems to not be the case. Anyone has some insights to this? And to be clear, I'm now looking for something more insightful than "your NAS is compromised, wipe it".

Unless your NAS has a new virtual network that accesses the multiverse those log-ins ARE from people/bots/apps at those IPs that literally logged into your device, whether directly or through a vulnerability it does not matter, they did, your NAS was exposed and was not properly secured at that time. If you can not get past that fact NO ONE here can help you further.

I repeat
There is a principle which is a bar against all information, which is proof against all argument, and which cannot fail to keep man in everlasting ignorance. That principle is condemnation before investigation.
—Edmund Spencer

[syncthing]

This post should be linked-to from any online thesauri trying to explain what "dripping-with-sarcasm" looks like.

+1

[Mousetick]

Anyone has some insights to this?

No, no one knows, apparently. As you have surmised, unknown inexistent users logging into your NAS is not normal and something is very very wrong. So it would be in your best interest to request assistance from QNAP. Only they can figure out what's going on.

[buiz_]

Anyone has some insights to this?

No, no one knows, apparently. As you have surmised, unknown inexistent users logging into your NAS is not normal and something is very very wrong. So it would be in your best interest to request assistance from QNAP. Only they can figure out what's going on.

Thank you for addressing my question! I'll dig further and report back here in case I find something that may be useful to others.

[Skwor]

Anyone has some insights to this?

No, no one knows, apparently. As you have surmised, unknown inexistent users logging into your NAS is not normal and something is very very wrong. So it would be in your best interest to request assistance from QNAP. Only they can figure out what's going on.

Thank you for addressing my question! I'll dig further and report back here in case I find something that may be useful to others.

[jaysona]

Those threads and the other posts in this thread deal with the many vulnerabilities of QTS. I get that. I got that before I started this thread. I know what I'm dealing with and I take the risks I want to take and that I find acceptable in relation to the importance of what I have on my NAS. I'm not a n00b throwing my vital data in the hands of hackers without caution or backup.

...and yet, you willingly expose a NAS that runs an OS riddled with more holes in it than a slice of Swiss Cheese has?

QTS has multiple 0-day vulnerabilities in it and there are ways to access the the NAS without needing to login.

So if we can put that aside along with the dripping sarcasm then what I'm still looking for is an actual answer to my actual question. How can users that don't exist on my NAS show up as having successfully logged on my NAS? I showed a screenshot that also shows that those users did not actually seem to use/access any resources on my NAS. Compromized or not, I would assume that for a user called "Alex" to successfully log on to my NAS, that user should actually be existing on my NAS, yet that seems to not be the case. Anyone has some insights to this? And to be clear, I'm now looking for something more insightful than "your NAS is compromised, wipe it".

Possibly, the user accounts do exist somewhere in the innards of the severely butchered and crippled Linux distro that QNAP has made, or new vulnerabilities have been exploited, maybe something else? Perhaps you should ask QNAP directly by opening a ticket.

I'm now looking for something more insightful than "your NAS is compromised, wipe it".

Your NAS has most likely been compromised, the only reaming prudent action to take is to wipe and reinitialize, I'd even go so far as to reinitialize the DOM as well using the firmware recovery procedure - as that's where I would focus my energies if I were an active malware developer. Just sayin'