Reddit user's web interface was exposed and security patches were about 18 months out of date; their 3-2-1 backup setup seemingly meant no data was lost
A Reddit user says files on their Synology DS918+ NAS were encrypted in a ransomware attack; analysis of logs and operating system files suggested the attack likely involved CVE-2024-10441, a remote code execution vulnerability revealed 18 months ago. The device had its web interface exposed to the internet and was roughly a year and a half out of date with security patches, according to a detailed write-up by user NakamuraHwang.
The incident highlights the risks of exposing network-attached storage devices to the internet without additional protections such as a VPN or SSH tunnel. NakamuraHwang, who appears technically proficient, described a series of missteps that led to the compromise, including an unpatched system and direct internet exposure.
The user had a 3-2-1 backup setup and seemingly did not lose any data. They attached the disks to a Proxmox machine for inspection; Synology's DSM operating system uses mdraid, so the disks can be mounted on another machine.
Analysis of logs and operating system files indicated that the attack likely exploited CVE-2024-10441, a remote code execution vulnerability for which Synology had published an advisory. However, multiple comments on the thread and elsewhere noted that Synology's user interface may indicate a device is up to date while critical security updates remain uninstalled, requiring manual installation.
According to the DSM manual, units from 2025 onwards have automatic updates, apparently implying that earlier models need to be configured for them. The Tom's Hardware report said Synology apparently has no direct channel, such as email notifications, to alert customers about critical security vulnerabilities; it said it was not reasonable to expect regular users to be aware of security bulletins. Package updates, including patches for vulnerabilities like PHP2Shell, must also be installed separately.
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.
§
Analysis
Why This Matters
The incident underscores that even tech-savvy users can fall victim to preventable ransomware attacks if devices are exposed to the internet and left unpatched.
It raises questions about how NAS vendors communicate security updates to customers, particularly for older hardware that lacks automatic patching.
The 3-2-1 backup strategy saved this user's data, reinforcing its importance for anyone storing critical files on networked devices.
Background
Network-attached storage (NAS) devices are popular for home and small-business file storage and backup. Synology is a leading NAS manufacturer. Exposing a NAS web interface directly to the internet is widely discouraged; best practice involves using a VPN or SSH tunnel. The CVE-2024-10441 vulnerability is a known remote code execution flaw that Synology patched in 2024.
Key Perspectives
NakamuraHwang (Reddit user): Described the attack in a detailed post, acknowledging a series of unforced errors including an internet-exposed device and outdated firmware, but noted that backups prevented data loss.
Community commenters and forum users: Reported that Synology's update UI can falsely indicate that a device is up to date while critical security patches require manual installation, and that automatic updates are only standard on units from 2025 onward.
Tom's Hardware analysis: Observed that Synology apparently lacks a direct notification channel for critical security vulnerabilities, and that package-level updates (e.g., PHP patches) must be installed separately, increasing the risk for average users.
What to Watch
Whether Synology improves its update notification process for older NAS models or introduces automatic updates retroactively.
How many similar incidents surface as attackers scan for unpatched, internet-exposed NAS devices.
The response from the NAS community: will more users adopt VPN or VLAN isolation after this case?
12 claims in this story checked against 1 source: 12 supported.
Show each claim
SupportedRansomware encrypted files on a Synology DS918+ NAS.Latest from Tom's Hardware: “who had files on their Synology DS918+ NAS encrypted by a ransomware attack”
SupportedThe NAS’s web interface was exposed to the internet.Latest from Tom's Hardware: “had its web interface exposed to the internet”
SupportedAnalysis of logs and operating system files suggested the attack likely exploited CVE-2024-10441.Latest from Tom's Hardware: “Investigation of logs and the operating system files revealed that the attack was likely performed by abusing the CVE-2024-10441 remote code execution vulnerability”
SupportedCVE-2024-10441 was revealed about 18 months ago.Latest from Tom's Hardware: “the CVE-2024-10441 remote code execution vulnerability, revealed a year and a half ago.”
SupportedThe NAS was roughly 18 months out of date with security patches.Latest from Tom's Hardware: “was roughly 18 months out-of-date with security patches”
SupportedThe incident details came from a write-up by Reddit user NakamuraHwang.Latest from Tom's Hardware: “Such is the tale of Reddit user NakamuraHwang, who had files on their Synology DS918+ NAS encrypted by a ransomware attack”
SupportedThe user had a 3-2-1 backup setup and seemingly lost no data.Latest from Tom's Hardware: “The tech has a 3-2-1 backup setup, so they seemingly didn't lose any data.”
SupportedMultiple comments said the interface could show a device as up to date while critical updates still needed manual installation.Latest from Tom's Hardware: “According to multiple comments on the thread and in other forums, the UI will happily tell you that your device is up to date, all while there are critical security updates that need to be manually installed.”
SupportedThe DSM manual indicates that units from 2025 onwards have automatic updates.Latest from Tom's Hardware: “The manual for DSM indicates that units from 2025 onwards have automatic updates”
SupportedThe report says Synology apparently lacks a direct channel, such as email, to warn customers about critical security vulnerabilities.Latest from Tom's Hardware: “Synology apparently doesn't have a direct channel to warn its customers of critical security vulnerabilities —a simple e-mail notification would suffice.”
SupportedThe report says it is not reasonable to expect regular users to know about security bulletins.Latest from Tom's Hardware: “it's not reasonable to expect them to even be aware of security bulletins.”
SupportedPackage updates, including the PHP2Shell patch, must be installed separately.Latest from Tom's Hardware: “package updates like the patch for the PHP2Shell vulnerability have to be installed separately, too.”
