IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

QNAP ransomware victims dealt double blow as firmware update hampers decryption

Emisoft releases decryptor for victims while QNAP explains why and how it controversially auto-updated user’s products

QNAP users affected by the DeadBolt ransomware incident last week have been dealt another blow as users report being unable to decrypt their files after paying the ransom because the company's controversial forced update removed the ransomware's binary.

Now available to download, Emisoft’s decryptor works only for victims who have paid the ransom but were unable to acquire an official decryptor from the ransomware operators before their network-attached storage (NAS) drive updated. The forced security update QNAP issued last week isolated the DeadBolt binary, making it inaccessible to users, but needs to be accessible to fully decrypt the victim’s device.

"To make this abundantly clear: this will not get you around paying the ransom," said Fabian Wosar, Emisoft CTO, on social media. "Victims will still need to provide the key. It is merely an alternative decryption tool if you can't use the mechanism provided by the threat actors due to QNAP forcing a firmware update."

Official QNAP support explained to users over the weekend that the forced update triggered QNAP's Malware Remover tool to "quarantine" the DeadBolt ransomware rather than deleting it. A support representative said users can contact the QNAP helpdesk team to remove the DeadBolt page block and use a decryptor key, should they obtain one, to begin the file decrypting process.

It's currently unconfirmed if the Emisoft decryptor can be used in the decryption process described by QNAP support, but IT Pro has contacted both Emisoft and QNAP for clarity.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

QNAP users were last week controversially subjected to a forced firmware update after a DeadBolt ransomware incident targeted and crippled thousands of NAS drives. Users expressed anger towards the Taiwan-based hardware firm for forcing the update without their permission and some argued their devices were left weaker than they were before.

Users reported losing large amounts of data after being hit with DeadBolt, including high-profile podcast host and MIT research scientist Lex Fridman, who lost 50Tb of data after being handed a 0.3 Bitcoin ransom demand (roughly £8,100 at the time).

Explaining the fiasco

QNAP published a press release today explaining how and why the forced update was issued to all QNAP customers, adding that it still recommends not exposing NAS products to the internet. 

The company explained that if the auto-update function for the 'Recommended Version' is enabled on a user's NAS drive, then the drive will automatically update to the firmware version QNAP believes to be the most secure. 

User's originally expressed confusion as to why their product underwent an auto-update, having not manually enabled the auto-update setting. QNAP support explained that with firmware version 4.5.0 the feature was disabled by default, but was enabled in firmware version 4.5.3 with users thinking the setting would transfer unchanged after upgrading to the newer version.

"Recommended version does not apply to every update," said QNAP support. "So people did not realise recommended update was enabled on their NAS. But after Deadbolt, we released a recommended update to protect from deadbolt. Because this update was set as a "recommended version", NAS with "recommended version" enabled updated.

"Having recommended version enabled by default did allow us to protect many NAS units. But if anyone does not want this feature, they can disable it."

The company added that it understood services could be interrupted during the update and that it is always looking to improve its products. Users can find further information in QNAP's official statement.

Chief points of contention were echoed in response to today's announcement with some users saying Universal Plug and Play (UPnP), a set of networking principles allowing devices to discover others on a shared network, should be disabled by default. This will disable port forwarding and secure the device, for the most part, from attacks such as the DeadBolt incident.

Others reiterated their concern over the absent warning users were given that an automatic update was coming, while one complaint that QNAP said it would consider implementing, was that firmware versions should have been backported so fixes could have been applied to users on both versions 4.x and 5.x.

Ransomware recap

QNAP released a security update on 27 January for the DeadBolt ransomware campaign it said had been "widely targeting" users' devices for a number of days. This was automatically initiated for all QNAP customers sparking fury in the community. 

More than 3,000 NAS drives were successfully encrypted with DeadBolt ransomware with ransom demands ranging between 0.3 Bitcoin to 50 Bitcoin for decryptor tools. Many individual and business users reported paying the ransom to restore access to their data at the time

QNAP justified the forced update as a difficult but necessary decision to secure the majority of NAS products around the world, but users expressed anger towards the firm for issuing the automatic patch.

Many owners of NAS drives operate on older firmware versions for various reasons, and updating to newer, safer releases can be an arduous process given the highly individualised configurations running from user to user.

Featured Resources

Big data for finance

How to leverage big data analytics and AI in the finance sector

Free Download

Ten critical factors for cloud analytics success

Cloud-native, intelligent, and automated data management strategies to accelerate time to value and ROI

Free Download

Remove barriers and reconnect with your customers

The $260 billion dollar friction problem businesses don't know they have

Free Download

The future of work is already here. Now’s the time to secure it.

Robust security to protect and enable your business

Free Download

Recommended

Qnap KoiBox-100W review: An intriguing alternative
video conferencing

Qnap KoiBox-100W review: An intriguing alternative

6 Sep 2022
Qnap TS-i410X review: Rock-solid network storage
network attached storage (NAS)

Qnap TS-i410X review: Rock-solid network storage

31 Aug 2022
Qnap TS-h1290FX review: Flashy desktop storage
Server & storage

Qnap TS-h1290FX review: Flashy desktop storage

22 Aug 2022
Qnap TS-873AU-RP review: A great storage package in a space-saving chassis
network attached storage (NAS)

Qnap TS-873AU-RP review: A great storage package in a space-saving chassis

16 Aug 2022

Most Popular

How to secure your hybrid workforce
Advertisement Feature

How to secure your hybrid workforce

23 Sep 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022
Why collaboration is key to digital transformation
Sponsored

Why collaboration is key to digital transformation

13 Sep 2022