In January 2021, reports surfaced of a backup-busting ransomware strain called Deadbolt, apparently aimed at small businesses, hobbyists and serious home users.
As far as we can see, Deadbolt deliberately chose a deadly niche in which to operate: users who needed backups and were well-informed enough to make them, but who didnt have the time or funds to give their backup routine the attention it really deserved.
Many ransomware attacks unfold with cybercriminals breaking into your network, mapping out all your computers, scrambling all the files on all of them in unison, and then changing everyones wallpaper to show a blackmail demand along the lines of, Pay us $BIGVAL and well send you a decryption key to unlock everything.
For large networks, this attack technique has, sadly, helped numerous audacious criminals to extort hundreds of millions of dollars out of organisations that simply didnt have any other way to get their business back on track.
Deadbolt, however, ignores the desktops and laptops on your network, instead finding and attacking vulnerable network-attached storage (NAS) devices directly over the internet.
To be clear, the decryption tools delivered by todays cybercriminals even when the amount involved is hundreds of thousands or millions of dollars routinely do a mediocre job. In our State of Ransomware 2021 survey, for example, half of our respondents who paid up nevertheless lost at least a third of their data. In fact, a third of them lost more than half of the data they paid to recover, and a disastrously disappointed 4% paid full price but got nothing back at all.
By exploiting a security vulnerability in QNAP products, the Deadbolt malware didnt need to get a foothold on your laptop first, and then to spread sideways through your home or business network.
A remote code execution (RCE) hole identified in QNAPs security advisory QSA-21-57 could be exploited to inject malicious code directly onto the storage device itself. (Like many internet-connected hardware devices, the affected products run a customised Linux distribution.)
So, if youd inadvertently set up your backup device so that its web portal was accessible from the internet side of your network connection the port thats probably labelled WAN on your router, short for wide-area network then anyone who knew how to abuse the security hole patched in QSA-21-57 could attack your backup files with malware.
In fact, if you were in the habit of looking at your device only when you needed to recover or review files you didnt have space to keep live on your laptop, you might not have realised that your files had been scrambled until you next went to the web interface of your NAS.
When you got there, however, youd be in no doubt at all what had happened to your data, because the Deadbolt attackers deliberately modified the portal page of the NAS itself to confront you with the grim news:
Intriguingly, the criminals behind this attack dont supply you with an email address or a website by which to get in touch.
The crooks instruct you to contact them simply by sending the blackmail money to a specific Bitcoin address (in current attacks, theyre demanding BTC 0.03, presently about $1250 [2022-03-23T15:00Z]).
They promise to send you the 16-byte decryption key you need via a return transaction, encoding the data as a transaction message on the public Bitcoin blockchain:
The business of using cryptocurrency blockchains for exchanging messages with cybercriminals is common these days. In the infamous Poly Networks hack, where a crook stole cryptocoins collectively worth about $600,000,000, the company notoriously negotiated with the attacker via messages on the Ethereum blockchain. After sending a rather bizarrely worded series of justifications for the cryptocrime, the attacker suddenly messaged 52454144 5920544f 20524554 55524e20 54484520 46554e44 21, which comes out as READY TO RETURN THE FUND! Poly Networks began referring to him as Mr White Hat; agreed he could keep $500,000 as a curious sort of bug bounty; and ultimately, if amazingly, got the lions share of the missing cryptocoins back.
Also, perhaps taking a leaf out of the playbook tried by the Kaseya ransomware criminals, the Deadbolt crew have included what you might call a meta-blackmail demands aimed at QNAP, the makers of the device itself.
For BTC 5 (just over $200,000 today), the crooks claim that theyll reveal the vulnerability to QNAP, although that offer seems redundant in March 2022 given that QNAPs QSA-21-57 bulletin states that it identified and patched the hole itself back in January this year.
And for BTC 50 (more than $2 million today), the crooks promise to provide a magic all-you-can-eat buffet ticket that will decrypt any device infected with the current strain of Deadbolt malware:
The Kaseya gang notoriously demanded $70,000,000 for their ultimate decryptor. (Whether that was in the hope that victims might rally together and actually pay up, or simply to thumb their noses at the world, we couldnt tell at the time.)
Interestingly, with one of the alleged perpetrators of the Kaseya attack now awaiting trial in Texas, we may yet find out more about that $70m blackmail note:
The good news in the Deadbolt story is that QNAP not only published a patch for the QSA-21-57 vulnerability back in January 2021, but also apparently went on to take the unusual step of automatically pushing out that update even to devices with automatic updating turned off.
The bad news is that the online internet security scanning service Censys is reporting that Deadbolt infections have suddenly leapt back onto its radar, with more than 1000 affected devices showing up in the past few days.
As it happens, spotting devices affected by this malware is fairly easy.
If a publicly accessible IP number has a listening HTTP server, then the first few lines of HTML sent back in the web servers main page will give away whether that the server has already been scrambled by Deadbolt (or, alternatively, that its deliberately pretending to have been attacked).
As you can see in the screenshots above, the Deadbolt extortion page has a dramatic, all-caps title that is easy to detect using a simple text search at the top the HTML page, which starts like this:
What we cant tell you is why these infections have returned.
Admittedly, 1000 visibly affected devices is a tiny number against the size of the global internet and the huge number of devices QNAP has sold, so its perfectly possible that these numbers have arisen entirely from devices that failed to update back in January and February, despite QNAPs efforts to update everyone regardless of their auto-update settings.
Its also possible that the crooks behind Deadbolt have come up with a brand new exploit, or a variation on the exploit they used before, though you might expect a bigger surge in new Deadbolt infections if the crooks really had come up with a fresh attack.
And its even possible that some unpatched devices that were theoretically at risk before, but werent exposed to the internet, have recently been opened up to attack by users hurriedly reviewing and revising their network configurations and perhaps promising themselves to make more backups more often in the light of current cybersecurity anxieties provoked by the war in Ukraine.
We suspect, however, that the Deadbolt crooks, or someone associated with them, simply decided to have another try, on the grounds that what worked before might very well work again.
Whatever the reason, youll be happy to know that no one seems to have paid up, because the Bitcoin address redacted in the screenshots above (we saw just one address, for victims and QNAP alike, in all the recent samples we looked at) currently shows a balance of zero, and an empty transaction history.
Fascinatingly, the Deadbolt crooks have left a tempting but as-good-as-impossible clue to that 50-bitcoin master decryption key, right in the blackmail page they install on each infected device.
If you enter a decryption key, the web page itself checks to see if its valid before activating the decryptor, presumably to prevent you from decrypting the data with the wrong key, which were guessing would leave you with doubly-encrypted, garbled data rather than stripping off the encryption originally applied.
To prevent you simply reading the decryption key out of the JavaScript source, the web page checks that the decryption key you enter has the SHA-256 hash it expects, rather than directly comparing your input with a text string stored in the code.
And although you can easily go forwards from the correct key to the matching hash, SHA-256 is specifically designed so you cant go the other way, thus allowing the right password to be verified if you know it already, but not to be recovered if you dont:
As you can see, theres a test for the one-off key unique to your infected device, but theres also a test that claims to check whether youve put in the multi-million dollar master key offered for sale to QNAP.
So, if you can figure out the input data that would produce a SHA-256 hash of 93f21756 aeeb5a95 47cc62de a8d58581 b0da4f23 286f14d1 0559e6f8 9b078052
youve just cracked this particular ransomware for everyone.
Heres our advice for protecting specifically against this malware, as well as protecting generally against network attacks of this sort:
When it comes to backups, you might find the 3-2-1 rule handy.
The 3-2-1 principle suggests having at least three copies of your data, including the master copy); using two different types of backup (so that if one fails, its less likely the other will be similarly affected), and keeping one of them offline, and preferably offsite, so you can get at it even if youre locked out of your home or office.
Remember to encrypt your backups so that stolen backup devices cant be accessed by the thieves.
If you dont have the experience or the time to maintain ongoing threat response by yourself, consider partnering with a service like Sophos Managed Threat Response. We help you take care of the activities youre struggling to keep up with because of all all the other daily demands that IT dumps on your plate.
Not enough time or staff? Learn more about Sophos Managed Threat Response:Sophos MTR Expert Led Response24/7 threat hunting, detection, and response
Original post:
Serious Security: DEADBOLT the ransomware that goes straight for your backups - Naked Security
- Google researchers have cracked a key internet security tool - Recode [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Letter: Internet security is in jeopardy - INFORUM [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- New internet security device launched to safeguard schools against child abuse - Phys.Org [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Everything You Need to Know About Cloudbleed, the Latest Internet Security Disaster - Gizmodo [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Data from internet-connected teddy bears held ransom, security expert says - Fox News [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- Emsisoft Internet Security 2017.2.0.7219 - TechCentral.ie [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- What you need to know about 'Cloudbleed,' the latest internet security bug - Globalnews.ca [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- Google cracks longtime pillar of internet security - MarketWatch [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- BullGuard | Internet Security and Antivirus protection ... [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- Internet Storm Center - SANS Internet Storm Center [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- Internet-connected 'smart' devices are dunces about security - ABC News [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Derry internet security expert warns that advanced internet technology 'a risk to us all' - Derry Now [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Firewall Test, Web Tools and Free Internet Security Audit ... [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Internet security in the spotlight: How is the internet safer today than it was 20 years ago? - Mobile Business Insights (blog) [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Jim Mullen: Unsocial internet security | Columnists | auburnpub.com - Auburn Citizen [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Internet security company launches a perfume line to promote cybersecurity - Mashable [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- Internet security - Wikipedia [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- Are you undermining your web security by checking on it with the wrong tools? - The Register [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Bruce Schneier on New Security Threats from the Internet of Things - Linux.com (blog) [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Carpe Diem: home internet security - KFOX El Paso [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Motivation Monday: home internet security - KFOX El Paso [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Medical records of 26m patients at risk because of GP surgeries' failing internet security - The Sun [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Free Internet Security | Why Comodo Internet Security Suite ... [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Internet Security Software | Trend Micro USA [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Fix crap Internet of Things security, booms Internet daddy Cerf - The Register [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- Internet of Things security: What happens when every device is smart and you don't even know it? - ZDNet [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- CUJO is cuter than Wall-E, and it's the only internet security device you'll ever need - Yahoo News [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- The Senate just voted to undo landmark rules covering your Internet privacy - Washington Post [Last Updated On: March 25th, 2017] [Originally Added On: March 25th, 2017]
- What the Cloudbleed disaster says about the state of internet security - Information Age [Last Updated On: March 25th, 2017] [Originally Added On: March 25th, 2017]
- Google Has Declared Symantec Harmful To Internet Security - UPROXX [Last Updated On: March 25th, 2017] [Originally Added On: March 25th, 2017]
- Internet Security Analysts: North Korea Is Planning a Global Bank Heist - Breitbart News [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- Internet Security Firm Confirms WikiLeaks 'Vault 7' At Least 40 Cyberattacks Tied to the CIA - The Ring of Fire Network [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- Homeland Security warns of 'BrickerBot' malware that destroys unsecured internet-connected devices - ZDNet [Last Updated On: April 20th, 2017] [Originally Added On: April 20th, 2017]
- A Global Industry First: Industrial Internet Consortium and Plattform Industrie 4.0 to Host Joint IIoT Security ... - Business Wire (press release) [Last Updated On: April 20th, 2017] [Originally Added On: April 20th, 2017]
- Mucheru urges private sector to boost investment in internet security - The Standard (press release) [Last Updated On: April 25th, 2017] [Originally Added On: April 25th, 2017]
- Cloudflare debuts a security solution for IoT - TechCrunch [Last Updated On: April 28th, 2017] [Originally Added On: April 28th, 2017]
- Russian-controlled telecom hijacks financial services' Internet traffic - Ars Technica [Last Updated On: April 28th, 2017] [Originally Added On: April 28th, 2017]
- Avira Internet Security Suite v15.0.26 - TechCentral.ie [Last Updated On: April 28th, 2017] [Originally Added On: April 28th, 2017]
- NSA To Limit Some Collection Of Internet Communication - NPR [Last Updated On: April 29th, 2017] [Originally Added On: April 29th, 2017]
- Report Indicates '10 Concerts' Facebook Trend Could Compromise Your Internet Security - Complex [Last Updated On: April 29th, 2017] [Originally Added On: April 29th, 2017]
- "Improving the World" through Internet Security: Chatting with David Gorodyansky, CEO of AnchorFree - Huffington Post [Last Updated On: May 3rd, 2017] [Originally Added On: May 3rd, 2017]
- Don't Fall For This Tech Support Scam Targeting PC Users - KTLA [Last Updated On: May 3rd, 2017] [Originally Added On: May 3rd, 2017]
- Yikes! Antivirus Software Fails Basic Security Tests - Tom's Guide [Last Updated On: May 3rd, 2017] [Originally Added On: May 3rd, 2017]
- Watch Hackers Sabotage an Industrial Robot Arm - WIRED [Last Updated On: May 3rd, 2017] [Originally Added On: May 3rd, 2017]
- Decoding Internet Security: Spear phishing - Washington Post [Last Updated On: May 5th, 2017] [Originally Added On: May 5th, 2017]
- From the Desk of Jay Fallis: To internet vote, or not to internet vote - BarrieToday [Last Updated On: May 7th, 2017] [Originally Added On: May 7th, 2017]
- Crippling cyberattack continues to spread around the world - Los Angeles Times [Last Updated On: May 14th, 2017] [Originally Added On: May 14th, 2017]
- Cyber Security Experts: Russia Disproportionately Targeted by Malware - Voice of America [Last Updated On: May 14th, 2017] [Originally Added On: May 14th, 2017]
- The Latest: 29000 Chinese institutions hit by cyberattack - ABC News [Last Updated On: May 15th, 2017] [Originally Added On: May 15th, 2017]
- Cyberattack Aftershock Feared as US Warns of Its Complexity - New York Times [Last Updated On: May 15th, 2017] [Originally Added On: May 15th, 2017]
- This week's poll: Priorities for improving internet security - The Engineer [Last Updated On: May 18th, 2017] [Originally Added On: May 18th, 2017]
- Akamai Releases First Quarter 2017 State of the Internet / Security Report - PR Newswire (press release) [Last Updated On: May 18th, 2017] [Originally Added On: May 18th, 2017]
- Do Macs get viruses? - PC Advisor [Last Updated On: May 18th, 2017] [Originally Added On: May 18th, 2017]
- Massive Ransomware Attack Underscores Threats To Internet Security - Benzinga [Last Updated On: May 19th, 2017] [Originally Added On: May 19th, 2017]
- Security News This Week: Hoo-Boy, Mar-a-Lago's Internet Is Insecure - WIRED [Last Updated On: May 20th, 2017] [Originally Added On: May 20th, 2017]
- Internet security firm calls for law to compel information sharing to ... - The Star, Kenya [Last Updated On: May 22nd, 2017] [Originally Added On: May 22nd, 2017]
- Check It Out: No need to unplug after reading books on internet security - The Columbian [Last Updated On: May 22nd, 2017] [Originally Added On: May 22nd, 2017]
- How to beat security threats to 'internet of things' - BBC News - BBC News [Last Updated On: May 25th, 2017] [Originally Added On: May 25th, 2017]
- Best Mac antivirus 2017 - Macworld UK [Last Updated On: May 25th, 2017] [Originally Added On: May 25th, 2017]
- Avira, Kaspersky Top Windows 10 Antivirus Tests - Tom's Guide [Last Updated On: May 25th, 2017] [Originally Added On: May 25th, 2017]
- Paranoid about internet security? Here are the most secure OS options - The American Genius [Last Updated On: May 28th, 2017] [Originally Added On: May 28th, 2017]
- Blockchain Offers Hope for the Broken Internet - Fortune [Last Updated On: May 28th, 2017] [Originally Added On: May 28th, 2017]
- New uses for RFID and security for the internet of things - Phys.Org [Last Updated On: May 31st, 2017] [Originally Added On: May 31st, 2017]
- Security Best Practices for the Internet of Things - Web Host Industry Review [Last Updated On: May 31st, 2017] [Originally Added On: May 31st, 2017]
- Internet infrastructure security guidelines for Africa unveiled - Premium Times [Last Updated On: May 31st, 2017] [Originally Added On: May 31st, 2017]
- In addressing internet security issues, make sure to provide solutions - Minneapolis Star Tribune [Last Updated On: May 31st, 2017] [Originally Added On: May 31st, 2017]
- Whistic Partners with the Center for Internet Security to Extend the ... - PR Web (press release) [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- Internet Security Alliance: NIST framework metrics should focus on threats - Inside Cybersecurity (subscription) [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- China cyber-security law will keep citizens' data within the Great Firewall - The Register [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- Cyber security: Africa gets Internet security guidelines - TheNewsGuru [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- China to Implement Its First Law on Internet Security After Ransomware Attack - Sputnik International [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- Decoding Internet Security: Ransomware - Washington Post [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- Internet security upgrade on course - Business Daily (press release) (blog) [Last Updated On: June 1st, 2017] [Originally Added On: June 1st, 2017]
- What's the Safest Laptop For Internet Security? - HuffPost [Last Updated On: June 2nd, 2017] [Originally Added On: June 2nd, 2017]
- Every Day Is Internet Security Day - The Chief-Leader [Last Updated On: June 3rd, 2017] [Originally Added On: June 3rd, 2017]
- 5 Reasons why internet security is crucial in 2017 - Techworm [Last Updated On: June 3rd, 2017] [Originally Added On: June 3rd, 2017]
- Are Pop-Ups An Internet Security Threat? - Good Herald [Last Updated On: June 4th, 2017] [Originally Added On: June 4th, 2017]
- 3 Ways Software Programs Can Help With Internet Security in 2017 - Geek Snack [Last Updated On: June 7th, 2017] [Originally Added On: June 7th, 2017]
- Inside Social Security: Make every day your internet security day - Santa Ynez Valley News [Last Updated On: June 7th, 2017] [Originally Added On: June 7th, 2017]
- SOCIAL SECURITY: Every day is internet security day - Palm Beach Post [Last Updated On: June 7th, 2017] [Originally Added On: June 7th, 2017]