Is QNAP Security Any Good?

Articles from Video for further reading

Connecting With Us
---------------------------------------------------

Lawrence Systems Shirts and Swag
---------------------------------------------------

AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store

UniFi Affiliate Link

All Of Our Affiliates that help us out and can get you discounts!

Gear we use on Kit

Use OfferCode LTSERVICES to get 5% off your order at

Digital Ocean Offer Code

HostiFi UniFi Cloud Hosting Service

Protect you privacy with a VPN from Private Internet Access

Patreon

#QNAP #Ransomeware #NAS

[LokiDaFerret]

You are spot-on about QNAP software. And it's pretty easy to see... Just press F12 after you have logged in and look at the console tab in the Chrome debugger. That area should be empty if you are writing good software. But what you will actually see is code that is in beta.... It has comments it has chrome warnings about using outdated techniques. And most importantly it has errors. Their software is a joke. DO NOT expose a QNAP NAS to the internet.

[Kattakam]

Tom, I have had a qnap for over 7 years and you are spot on. The company has several backdoors and I keep finding their help service process running even when I scour around to kill. This help service give them full access to your device and information. Back in 2015 when I got hit with a bootloop attack they where able to access (rootkit) and bring it out. Of course the raid tables where gone but it booted. After this I removed all data and functions except plex. I just don’t trust them and their ability to maintain security.

[PineapplePi]

I'm so glad that i chose Synology instead of QNAP 6 years ago. My DS415+ has been running until today. Not only that the device can last so long, I'm surprise that DSM7.0 is still being supported for my old device until today.

[OnesimusX]

So this post is just saying "Don't buy QNAP, because they're insecure." Sounds pretty simple to me. Got it! Thanks Lawrence.

[Richard]

I love my old qnap 8 Bay nas.. upgraded to 16gb memory from the stock 4gb removed the factory 500mb USB flash and put in an ssd then installed truenas core 😀

[keyboard_g]

This is not the first time for QNAP. If they can force an update, so can a threat actor. They are dead to me.

[MrLocoAndrew]

Glad i just finished moving over the Synology from Qnap. Always had issues and did a firmware update and screwed over my raid 5. 20TB i couldnt reclaim unless i wiped it all! Bought the Synology that you did a video on and couldn't be happier!!!

[deonh]

It's a pity because they have way more hardware configuration options than Synology, but I have always found the Synology OS more polished. Have been on Synology for many years and have always found them very robust and reliable - the  of the NAS world ;)

[GianeshwarJamwal]

Security is one of the reason, I kept my QNAP behind Pfsense firewall and VPN configured on it. Prior to that I used get lot of unknown login attempts on my NAS as DNS was exposing the public I.P

[ChuckyGang]

At our datacenter we had 2 12Bay QNaps used for backups (one backup and one backup of the backup) they randomly threw out disks.. in one year over 10 (!) disks where thrown out by the system. need I say that those are now being replaced with truenas solutions instead?

[tofu_golem]

Thanks for your video. I almost bought a QNAP instead of a Synology just because they had 2.5 Gbe NIC at the consumer level.

[koma-k]

It's a bit saddening, because the three(!) QNAPs I have have been rock solid for 10+ years, and the one time I managed to trash my RAID config (granted, I had help from the "intelligent" automatics and how it handles new disks...) support were very helpful and got everything back for me, despite being out of warranty for years at the time. I've not had any forced updates, so I'm wondering if this is a feature of the newer 64-bit platform? I'm also not running any services beyond CIFS, NFS and iSCSI nor are there any ports forwarded to any of them, so I'm crossing fingers that I'll be good until my home-built TrueNAS box is up and running properly.

[darekw]

You must act wisely. I have 2 QNAPs. The first is cut off from the internet (I have important data there), the second is cheap and connected to the network and has regular copies, including a disk image. If a hacker deletes or encodes my data, I will recover it quickly. However, QNAP's internet connection is not an important part of my network. Synology is lucky because it is a much less popular NAS than QNAP.

[sklise]

Crazy with the force update and Iscsi commentary and impacting 3600+ devices. I know some companies have firmware that can't be rolled back do to "major" fixes. I'm guessing qnap management thought the threat was so bad, they forced the update due to the potential impact. A bit scary that they have a backdoor to push this out (so thanks for relaying that).. what if the "push"from QNAP is compromised. Security is everyone's problem.

[Gearbhall]

I have a QNAP that I have overall been very happy with overall, however I saw tons of login attempts as admin (which I disabled during the initial configuration) and removed the cloud component of it as a result of that. I have remote access VPN so if need to get to it when I am away from home I can, but it shouldn't be reachable without breaching my environment in some other kind of way first. It does suck that the cloud component of that isn't really usable though.

That said as a company their security posture is absolutely unacceptable.

[HermanIdzerda]

Have had security problems with QNAP some years ago. Caused a lot of problems for me personally. Never any QNAP for me again.

[ig]

For years had issues with qnap, all the time security updates, nearly never could run the nas for a week without restart because of updates

[mashiroshiina]

How about the security of QNAP 10GbE desktop managed switches? I was considering buying a QSW-M1208-8C instead of a NETGEAR ProSafe XS716T - since NETGEAR also have a poor reputation for firmware updates frequency / security and they only recently released a security firmware update for the XS716T switch after TWO YEARS (2019-2021) - at least the QSW-M1208-8C seems to have gotten updated every 3 months or so since early 2021 going by their website change-log.

QNAP's managed switch GUI looks more modern / user friendly than NETGEAR and their most recent switch update states they've added digital signing to firmware and prevent downgrading to an earlier version.

So whilst QNAP NAS devices might not be recommended from a security standpoint, does the same opinion also apply to their managed switches?

[seeingblind]

Hardcoded session ID = "unintentional backdoor" 🤨🧐

[jnagarya]

QNAP and Synology are based in Taiwan. Taiwan was established and remained a dictatorship for many decades. It's in the mindset to force updates.