D-Link Forums

The Graveyard - Products No Longer Supported => D-Link Storage => DNS-320L => Topic started by: davidr1 on June 11, 2017, 12:42:19 PM

Title: DNS320L - Ransomeware exploit
Post by: davidr1 on June 11, 2017, 12:42:19 PM
OK I have used an APP on my IPAD to check the strength of the signal around the house.  I has also done a search of open ports.  The app is legit  and is from trend micro. 

One of the things that it is recommending is that to stop ransomware attacking your NAS is to close ports 135 and 445.   Now I have done this on Windows 10 but the open ports still show up on the wifi signal scan. 

I am now confused because you cant access the ports within the NAS to close these. 

I have downloaded ClamAV as a precaution.

AM I looking at this from the wrong perspective?  ie I need to closes the offending ports on the actual router not the NAS?

I have a SKY Hub in the UK but I cant find anywhere on this to block ports other than close UPNP which would stop anyone from accessing the cloud drive I understood.

Is this a redherring with Trend Micro or is it a genuine concern that needs to be looked at with regards to the NAS? 

My thinking is that if there is an exploit and it gets onto the NAS you are up **** creek without a paddle as all of your backup will be held to ransome unless you pay the fee or an AV fix comes out. 

On another note anyone think that ClamAv is of any use?

Here is a link to t3eh Tend Micro page:

http://www.drcleaner.com/useful-guidance-wannacrypt-attacks/

NOTE That to get to this page you have to go via

http://www.trendmicro.co.uk/?utm_source=bing&utm_medium=cpc&utm_campaign=UK%20-%20Core%20Brand%20-%20BMM%20(WG)&utm_term=%2Btrend%20%2Bmicro&utm_content=Brand%20-%20trend%20micro

and click on the home free tool section.  (but you could also do commercial if you wanted to)

Regards and tanks in advance.
Title: Re: DNS320L - Ransomeware exploit
Post by: FurryNutz on June 11, 2017, 12:48:17 PM
Link>Welcome! (http://forums.dlink.com/index.php?topic=48135.0)


What is  the model is the main host router?

Do you have remote access configured on the DNS?

Might see if main host router mfr has any FW updates. If not, Might connect up a external router like a DIR series from D-Link which has better security features and uPnP is kept up to date and secure. You don't need uPnP enabled and you can use port forwarding for remote access. Check with your routers Mfr for help and information on this.
Title: Re: DNS320L - Ransomeware exploit
Post by: davidr1 on June 11, 2017, 01:11:47 PM
Hi  SKY wont let you have a router other than their one.  The version is B I believe and I have the most up-to-date firmware. I will review your response  tomorrow.

The point I wastrying to make should we be worried or not?
Title: Re: DNS320L - Ransomeware exploit
Post by: FurryNutz on June 11, 2017, 01:22:28 PM
Does the SKY router have a DMZ that you have access to by chance?