ech0raix

There is no offical statement to this from Zyxel till today. We did not know, how the NAS was hacked. Very bad customer service, this was my last product from this company !

Although I agree that ZyXEL could have said something about this malware, I think it's perfectly possible that ZyXEL also doesn't know which vulnerability is used to get in. There are no logs. The malware itself tries to hide itself, and how it got in. When you look at the releasenotes of ABAG.14, you see that some vulnerabilities are addressed:

[SI-1545][Issue 3-2] Privilege escalation vulnerability 2

[SI-1545][Issue 4] Remote code execution vulnerability

[SI-1545][Issue 5] Arbitrary file upload and remote code execution vulnerability

[SI-1545][Issue 6] Unauthenticated backdoor vulnerability

[SI-1545][Issue 7] Weak password generation for privileged user vulnerability

But I can imagine that not everything is addressed. Finding vulnerabilities is tough work. Yesterday it was announced that a vulnerability is found in openssh. The story reads like a detective novel. It has been there for years, and openssh is one of the best monitored software package in the world.

Hello

LowLevel format is not possibel with the NAS at normal Way.

1. Remove all drives

2. Do a factory reset

3. Upgrade to the newest FW. ABAG.15

4. Insert only one Drive. All Data are not readable because it was from a Raid5, so in my Opinon it should be save enought.

5. Create a new Volume with that Drive.

Raid1 makes after this no sense for me. Create two or three single volumes with the three HDDs and use one of them for internal Backup.

Access from Outside to the NAS in the future only via VPN. (e.g. with Wireguard from the Fritzbox )

@Macace

Are here also offical Zyxel workers, as in the past in the old forum?

Yes, but not often. You can recognize them on their nicknames starting with Zyxel_.

A main problem from the NAS also is, there is no automatic warning possible, that the firmware is old and should be update. Which user look to this when his NAS works.

What do you mean? A sonic alarm that a new firmware is available? E-mail? AFAIK the firmware warns you when a new firmware is available when you login on the webinterface. (Unless you switched off the automatic check).

And yes, the firmware is old. I suppose that is one of the reasons that a Zyxel costs half of what a corresponding Synology costs.

@Macace

Hello

I was going to my local PC shop and bought two new Hard Disks.

1 Before mounted HD’s in my NAS 542, I removed all old HD’s,

2 Made a factory reset (once again) and updated firmware to ABAG.15.

3 Mounted the two brand-new HD’s and power up. (100% clean HD’s)

4 After power up, select RAID 1 (Two HD’s)

5 All looks OK, login, change password, check both HD’s installed correct.

6 BUT, after 10 minutes, something strange happened:

Both HD’s was very byssi, the LED’s was flashing very fast. (Maybe it is normal ?)

I was a little worried, so I made check/screen-dumps of the log file.

Log (Partly):

Approximately 12 minutes after power up:

Class: backup Severity: info Message: zysync server v2.00 starting, listening on port 873

Approximately 20 minutes after power up:

Class: user Severity: notice Message: Add new user zin7hcFg_V07- - - -

After above, I made a check of NAS542 registered users:

#1: admin System default user (After factory reset)

#2: pc-guest Guest (After factory reset)

#3: zyxel@”My e-mail addr” Cloud user (Automatic Add-on user after power-up?)

I am a little surprised over user #3, I have used this mail address to Zyxel registration for 8 years ago? (Not since, I open normal a specific mail address to companies).

After a factory reset, I expected all these setup was total cleared?

After approximately 25 minutes, I powered NAS542 down, because of bad filling, that something was wrong!

I have removed both new HD’s and made a new factory reset, so now I’ am standby once again.

What’s happened inside this NAS542?