Reflash NAS540 via SD card slot? (Recover from probable Hack)

I will have to order a compatible TTL level converter.
I guess that will give me some chance at seeing if its stable enough to recover.
Point me to how to run memory and CPU diagnostic on hardware first.
If hardware is bad then no point trying to get good flash.


But definitely was NEVER flashing correctly.
Never shut itself down even with hours of waiting.
Looked like a lot of cycling: booting up, doing something for 3-10 minutes then rebooting. 
Never any orange light that I recall.

Fixing this box will be delayed a couple weeks for USB to TTL 3.3V cable to arrive. 

But thinking about buying new NAS 540 to get drive back online then selling this box when firmware is working again. But is that worthwhile?

Is there a wiki page etc for how to remount a RAID 5 (4 disk) array from a compromised system in a secure way? Other than wiping all data,  that is. 

I am guessing that there is a possibility that the RAID 5 drives have malware on them ready to reload. Not big threat if infected firmware is required to load that. But if malware is stored as something uninfected firmware might load and execute from disk...

--- as NAS application if it was Zyxel specific attack (unlikely but possible)
--- not sure about what NAS stores on disk as far as mount points for CRON and other standard shell startup scripts. Much more likely depending on what "just supply an executable file with this name" hooks exist.

Anyways I would appreciate pointers to any material on how to recovery data from RAID 5 disks once a box with good firmware is available. That is instructions on how to do that without getting compromised by any malware left on disk. 

I am guessing that an extra single disk could be mounted as non-RAID to store recovery tools & then when ready a degraded RAID 5 array (3 of 4 disks) could be mounted and scanned etc. Once cleaned the extra disk would be removed and the remaining RAID 5 disk inserted for the rebuild process. That last RAID 5 disk no longer being capable of loading malware -- especially if it was wiped.

Mounted the NAS540 RAID5 drives under a Ubuntu server. Found 3 RAID partitions  MD0, MD1, MD2.   MD2 appears to be my ext4 DATA volume. MD1 is Linux swap formatted. Haven't looked deeply yet but the data volume appears intact. 

Is MD0 what you called the system volume? And is sysdisk.img what you were referring to as the system data blob?  If so is there some sort of pre-cautionary reformat or partition delete that I could do? If I understood you correctly a NAS540 with correctly working firmware would automatically be recreated that system volume from from scratch if it was missing. Would recreating or deleting the swap partition cause any problems? Or does BusyBox automatically sanitize the swap space on restart?

I am assuming that the main reconfiguration would then be recreating NAS users, groups, and file-groups access rights which would then be stored on the system volume between boots. I assume that is a relatively simple process that could easily be reapplied to the top data volume folders.

I am thinking this route because if I understood correctly the system blob is only deleted if the successfully rewritten firmware version is different than the firmware version that was in effect when the system blob was written. I had just updated to the new firmware a couple weeks before the intrusion and plan to restore to that version -- so versions would be equal. Thus manual delete might be good to make sure that system and swap partitions have no super clever hacks to carry over effects of intrusion after firmware is fixed.

Got the serial TTL level converter.  But got one big question after disassembling the NAS540 box to expose the main board and port.   I noted that the metal drive enclosure also provided heatsink capability that is now removed. 

So do I need temporary heatsinks for CPU and that other chip while communing with Busybox via serial and attempting to reflash? Or will things run slow (CPU on-die thermal protection slow down) and cool enough that no heatsinks are needed without disks connected and running full speed etc?

If I had something on hand suitable for temporary heatsinks I would just slap them on to be safe. I will need to order something if temps are suggested.