Taiwanese hardware vendor QNAP has published a security advisory today warning customers of a new malware strain named Dovecat that is currently targeting its line of network-attached storage (NAS) devices to abuse local resources and mine cryptocurrency behind users’ backs.
The company said the malware is currently spreading by connecting to QNAP NAS systems left exposed online using weak passwords.
Today’s security advisory comes after the company began receiving reports from its users last year about two unknown processes —named dovecat [1, 2] and dedpma— that were running non-stop and consuming the device’s memory.
Matthew Ruffell, a Canonical software engineer and the founder of Dapper Linux, analyzed the malware last year when it found it on an Ubuntu system.
According to his analysis, the malware was capable of infecting any Linux system but appeared to have been specifically designed for the internal structure of QNAP NAS devices.
The use of the “dovecat” process name wasn’t accidental either, as the malware tried to pass as Dovecot, a legitimate email daemon that ships with the QNAP firmware and many Linux distros.
But as Ruffell pointed out, Dovecat attacks were indiscriminate. Similar infections were also reported by users of Synology NAS devices, where the malware also appeared to have managed to run without problems.
Since the infection vector was linked to weak passwords, to prevent infections with this new threat, QNAP told users to:
- Use stronger admin passwords.
- Use stronger passwords for database administrators.
- Disable SSH and Telnet services if not in use.
- Disable unused services and apps.
- Avoid using default port numbers (80, 443, 8080 and 8081).
- Update QTS to the latest version.
- Install the latest version of Malware Remover.
- Install Security Counselor and run with Intermediate Security Policy (or above).
- Install a firewall.
- Enable Network Access Protection to protect accounts from brute force attacks.
- Follow best practices for enhancing NAS security.
But in the grand scheme of things, Dovecat is not the first malware strain to target QNAP devices. QNAP storage systems were also previously targeted by the Muhstik ransomware, the QSnatch malware, the ec0raix ransomware, and the AgeLocker ransomware.
