Anyone who has downloaded HandBrake on Mac between [02/May/2017 14:30 UTC] and [06/May/2017 11:00 UTC] needs to verify the SHA1 / 256 sum of the file before running it.
Anyone who has installed HandBrake for Mac needs to verify their system is not infected with a Trojan. You have 50/50 chance if you’ve downloaded HandBrake during this period.”
If you have Handbrake installed on your Macs, you should check if it is compromised by this Trojan.
“Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores.”
In the early Sunday morning of August 3, 2014, a tweet by Mike Evangelist was linked on Hacker News.
Lovely. My @Synology NAS has been hacked by ransomware calling itself Synolocker. Not what I wanted to do today. pic.twitter.com/YJ1VLeKqfY
I was somewhat scared by this news as some users at Synology forums reported that they were also victims of SynoLocker which is a CryptoLocker malware which specifically targets Synology NAS. I am managing numbers of Synology NAS for a few small offices and homes. Granted that none of them are directly connected to the Internet, but I have to make sure none of them would be hacked and crypto-locked.
Make sure your Synology NAS is running the latest DSM Operating System.
For now, disable the QuickConnect service.
Disable all port-forwarding if your Synology DiskStation is behind a NAT Firewall. This is a definite inconvenience; better to be safe than sorry.
More importantly, back-up the content of your Synology NAS. Should anything happen, you still have your data. My colleague has a great advice on backing up:
As always, if you have data on your Synology that you consider irreplaceable, make sure that you have it backed up to. I’d recommend using the built in Amazon S3 client. It’s cheap and fairly easy to set up, and should help you in case of a disaster.
I personally also run a backup to another hard drive locally for rapid recovery.
Malware comes with interesting way to deceive users that they are not malicious in any ways. This particular malware has a peculiar icon which looks like a folder marked “ENLISTED” and photo of U.S. Marine.
This particular malware bears filename of “svc-mdek.exe” which is classified as “Rogue.WindowsExpert” by MalwareBytes Anti-Malware.