1/6 eCh0raix Ransomware - Security Advisory qnap.com/en/security-advisory/QSA-20-02 Products KoiMeeter KoiBot KoiBox QTS QTS is the operating system for entry- and mid-level QNAP NAS. WIth Linux and ext4, QTS enables reliable storage for everyone with versatile value-added features and apps, such as snapshots, Plex media servers, and easy access of your personal cloud. System Applications QuTS hero QuTS hero is the operating system for high-end and enterprise QNAP NAS models. With Linux and ZFS, QuTS hero supports advanced data reduction technologies for further driving down costs and increasing reliablility of SSD (all-flash) storage. System Applications QuTScloud https://www.qnap.com/en/security-advisory/QSA-20-02 https://www.qnap.com/go/solution/KoiMeeter/ https://www.qnap.com/go/solution/koibot/ https://www.qnap.com/go/product/koibox-100w 2/6 QuTScloud is the operating system for QNAP Cloud NAS virtual appliances. With the possibility of on-premises and cloud deployment, QuTScloud enables optimized cloud data usage and flexible resource allocation at a predictable monthly cost. System Applications QES QES is the operating system for dual-controller QNAP NAS models. With FreeBSD and ZFS, QES is flash-optimized, capable of driving outstanding performance for all-flash storage arrays. System Overview Product ES1686dc ES2486dc Resources ZFS Advantages RAID Calculator QNE Network QNE Network is the operating system for QuCPE, QNAP's universal customer premises equipment series. Run virtual network functions, freely configure software-defined networks, and enjoy benefits such as lowered costs and reduced management efforts. System Overview QuWAN Network Manager Service Composer AMIZ Cloud Applications Security pfSense QuFirewall QVPN Cloud AMIZ Cloud https://www.qnap.com/go/qes/2.2/ https://www.qnap.com/go/product/es1686dc https://www.qnap.com/go/product/es2486dc https://www.qnap.com/go/solution/qnap-zfs/ https://enterprise-nas.qnap.com/en/calculator/ https://www.qnap.com/go/operating-system/qne-network/ https://www.qnap.com/go/solution/quwan-sd-wan https://www.qnap.com/go/software/network-manager https://www.qnap.com/go/solution/service-composer/ https://www.qnap.com/go/software/amiz-cloud https://www.qnap.com/go/solution/pfsense/ https://www.qnap.com/go/software/qufirewall https://www.qnap.com/go/software/qvpn-service https://www.qnap.com/go/software/amiz-cloud 3/6 IT Management HybridMount SD-WAN QuWAN QuWAN Orchestrator Mobile Apps Mobile Apps QSS QNAP Switch System (QSS) is the configuration interface for QNAP's managed switch series. Enable management functions such as link aggregation, VLAN, and RSTP, to take care of your network topology with ease. System Overview QVR Pro QVR Pro is the network video recorder software for QNAP's QVR Pro video surveillance appliances. QVR Pro can be also used with a series of apps, such as face recognition and door access control, making it versatile for a range of scenarios. System Overview Applications QVR Smart Search QVR Center QVR DoorAccess QVR Guard QVR Human Resources Surveillance NAS Selector QVR Pro Camera Compatibility List QVR Face QVR Face is a smart facial recognition solution featuring real-time live streaming video analytics from connected cameras. It can be integrated into multiple scenarios to provide intelligent attendance management, door access control management, VIP welcome systems and smart retail services. System https://www.qnap.com/go/software/hybridmount https://www.qnap.com/go/solution/quwan-sd-wan https://quwan.qnap.com/ https://www.qnap.com/go/mobile-apps https://www.qnap.com/go/solution/qnap-switch-system https://www.qnap.com/go/software/qvr-pro https://www.qnap.com/go/software/qvr-smart-search https://www.qnap.com/go/software/qvr-center https://www.qnap.com/go/software/qvr-dooraccess https://www.qnap.com/go/software/qvr-guard https://www.qnap.com/go/software/qvr-human https://www.qnap.com/go/qvr-nas-selector/ https://www.qnap.com/go/compatibility-qvr-pro 4/6 Overview QVR Face Tiger QVR Face Insight QVR Face Link Resources QVR Face & NAS/NVR Selector QVR Elite QVR Elite is the subscription-based network video recorder software for QNAP's QTS, QuTS hero, and QNE Network operating systems. Its low monthly fee enables homes and small businesses to build a cost-effective and flexible video surveillance system. System Overview QVR Smart Search Resources Surveillance NAS Selector QVR Elite Camera Compatibility List Smart Video Solutions QNAP smart video solutions provides integrated intelligent packages such as video conferencing and smart retail, boosting productivity for individuals and businesses. Video Conferencing KoiMeeter KoiBot Smart Retail KoiRetail << Back to Security Advisory List Resolved eCh0raix Ransomware Release date: June 8, 2020 Security ID: QSA-20-02 Severity: High CVE identifier: N/A Affected products: QNAP NAS devices running Photo Station Status: Resolved https://www.qnap.com/go/solution/qvr-face/ https://www.qnap.com/go/software/qvr-face-tiger https://www.qnap.com/go/software/qvr-face-insight https://www.qnap.com/go/software/qvr-face-link https://www.qnap.com/go/qvr-face-selector/ https://www.qnap.com/go/software/qvr-elite https://www.qnap.com/go/software/qvr-smart-search https://www.qnap.com/go/qvr-nas-selector/ https://www.qnap.com/go/compatibility-camera/ https://www.qnap.com/go/solution/koimeeter-2/ https://www.qnap.com/go/solution/koibot/ https://www.qnap.com/go/software/koiretail https://www.qnap.com/en/security-advisories?ref=security_advisory_details 5/6 Summary The eCh0raix ransomware (MR1904) has been reported to target QNAP NAS devices and exploit certain vulnerabilities in earlier versions of QTS and Photo Station. We have already fixed these issues in recent releases since September 2019. QTS: QTS 4.4.1: build 20190918 and later QTS 4.3.6: build 20190919 and later Photo Station: QTS 4.4.1: Photo Station 6.0.3 and later QTS 4.3.4 - QTS 4.4.0: Photo Station 5.7.10 and later QTS 4.3.0 - QTS 4.3.3: Photo Station 5.4.9 and later QTS 4.2.6: Photo Station 5.2.11 and later Recommendation To secure your device and to protect your data from ransomware attacks and unauthorized usage, we strongly recommend updating QTS and Photo Station to their latest versions. Important: Regardless of your current QTS version, QNAP strongly recommends updating your QTS to the latest available version for your NAS model to ensure that your device can benefit from vulnerability fixes. You can check the product support status of your NAS model. Installing the QTS Update 1. Log on to QTS as administrator. 2. Go to Control Panel > System > Firmware Update. 3. Under Live Update, click Check for Update. QTS downloads and installs the latest available update. Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device. Updating Photo Station 1. Log on to QTS as administrator. 2. Open the App Center, and then click . A search box appears. https://www.qnap.com/en/security-advisory/nas-201911-25 https://www.qnap.com/en/product/eol.php 6/6 3. Type “Photo Station”, and then press ENTER. The Photo Station application appears in the search result list. 4. Click Update. A confirmation message appears. Note: The Update button is not available if you are using the latest version. 5. Click OK. The application is updated. Revision History: V1.0 (June 8, 2020) - Published