Network attached storage maker QNAP’s customers have reported being hit by a mystery issue that disables software updates by hijacking entries in host machines’
hostsfile.The full effects are, as yet, unknown – but users have reported that the most visible symptom is that some 700 entries are added to the
/etc/hostsfile that redirect a bunch of requests to IP address 0.0.0.0.This, said forlorn QNAP forum user ianch99, stopped his antivirus from updating by sinkholing all of the software’s requests to the vendor’s website. Others reported that the Taiwanese NAS appliance maker’s own MalwareRemover was borked, though it is not known whether these two things are linked.
“If you remove these entries, the update runs fine but they return on after rebooting,” posted ianch99. So far the only cure appeared to be a script provided by QNAP itself, which one helpful Reddit user posted the link to after apparently being given it by one of the storage firm’s techie in live chat.
Other users publicly wondered about the QNAP’s seeming reluctance to say anything about the issue, with a Reg reader telling us: “The wider QNAP-using population could perhaps do with a heads-up from your esteemed organ.”
QNAP failed to respond when The Register asked the company to comment on these goings-on, and has made no public statement at the time of writing.
A couple of years ago firmware from the Taiwanese headquartered biz was discovered to have a catastrophic bug that corrupted data on RAID drives during a rebuild “through faulty calculations”. It was eventually patched.
Source: QNAP NAS user? You’d better check your hosts file for mystery anti-antivirus entries • The Register
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft