Archive for Synology

Synology Users Should Be Afraid Of C3RB3R Ransomware

Posted in Commentary with tags on October 30, 2026 by itnerd

Over the last few days, users of Synology products have been hit by C3RB3R Ransomware. This apparently encrypts their drives and then the users are charged $3000 to $6000 in Bitcoin to release the contents. Affected files reportedly receive the LOCK3D extension. Most of the reports that I have heard of are in South Korea. But I have heard reports elsewhere.

Now security researchers have come out with two vulnerabilities that cover this. These are CVE-2026-13639 and CVE-2026-13684 and both are a 9.8 out of 10 which make them today problems. Synology has also noted this to make your life easier. If you have a Synology box, you should be running at least these versions:

DSM BranchMinimum Fixed Version
DSM 7.47.4-90075
DSM 7.37.3.2-86009-4
DSM 7.2.27.2.2-72806-9
DSM 7.2.17.2.1-69057-12

If there are updates to the above versions available, install them. But a security patch addresses the underlying vulnerability but doesn’t reverse existing encryption. Thus you still need a separate recovery strategy. For example, I recommend backing up the NAS to BackBlaze as if you get pwned by hackers, you simply wipe the NAS and restore it from the backup.

Other things that you should consider are:

  1. Never, ever expose your NAS to the Internet. Because if they can’t see it, they can’t hack it.
  2. Review all accounts with administrative access to the NAS. Remove unused accounts and assign only the permissions each user requires. Avoid using administrator credentials for everyday file access. And for bonus points, enable multifactor authentication if you can.

Now Synology isn’t the only company to be a target of hackers. QNAP for example went through this. The point is that you have to be aware to the danger and take action to minimize the danger to yourself and your organization. Because taking no action is not a strategy. Ever.

Leave a comment »

Synology partially drops support for third-party drives in their new NAS offerings

Posted in Commentary with tags on April 17, 2025 by itnerd

I’ve been planning on replacing my QNAP NAS with one from Synology for a few months now. And I also have been recommending them to clients for years now. But I am rethinking both of those based on this story from Tom’s Hardware:

Synology’s new Plus Series NAS systems, designed for small and medium enterprises and advanced home users, can no longer use non-Synology or non-certified hard drives and get the full feature set of their device. Instead, Synology customers will have to use the company’s self-branded hard drives. While you can still use non-supported drives for storage, Hardwareluxx [machine translated] reports that you’ll lose several critical functions, including estimated hard drive health reports, volume-wide deduplication, lifespan analyses, and automatic firmware updates. The company also restricts storage pools and provides limited or zero support for third-party drives.

For reference, precious few companies make hard drives, and Synology is not one of them. As such, a self-branded hard drive is merely a drive from a major vendor, like Seagate, Toshiba, or Western Digital, that gets a new sticker slapped on it alongside a potential custom firmware that serves as a sort of DRM, unlocking the correct functionality from the host device (in this case, a NAS).

The 2024 Synology models and older are not affected by this change. Still, those upgrading to or purchasing the latest Plus Series device, set to be released this year, will have to buy their drives directly from Synology or its certified suppliers to maximize their system. Because of this, you won’t be able to pick from the best hard drives if you get Synology’s latest Plus Series NAS Systems.

Is this about providing the best user experience? Or is this really about taking more money out of users pockets? I can argue this both ways as hard drives compatibility with NAS products can be really fiddly and troublesome at times. So going this route, this solves this problem as Synology has total control. Then there’s the fact that when it comes to issues with NAS products, consumers blame the NAS and not the hard drive company. By going this route, that problem is removed.

But at the same time I have to wonder if this is a way for Synology to line its pockets with cash. I say that because companies like QNAP aren’t going this route. So one has to wonder how much of a problem this really is. I’ve never had an issue with any NAS that I’ve built for myself or for a customer. But I am a small sample size relative to the broader market. Thus it will be interesting to see how this plays out.

Leave a comment »

Review: Synology DS920+ DiskStation 4-Bay NAS With Western Digital Red+ 4TB SATA Drives

Posted in Products with tags on September 19, 2022 by itnerd

I have a client who needed to replace a two bay NAS as a means to backup his business related files. It in turn backs up to BackBlaze. The problem was that this NAS was 10 years old and the mean time between failures for spinning hard drives is 5 years. Which means that he could be potentially facing a situation where he could have a hard drive failure. It also was over 80% full from a storage perspective. So he commissioned me to build him a new NAS. And this is what I got him:

This is the Synology DiskStation DS920+ is a four-bay network attached storage (NAS) device that is easy to expand and comes with a wealth of Synology and third-party apps. I went this route because he already had a Synology NAS and was familiar with how it worked. Plus it does not have the security issues that QNAP NAS devices have. This NAS is designed for homes with power users or small-to-midsized business (SMB) users.

Being a four bay NAS, I had to get him four hard drives so that I can do a RAID 5 setup which means that one drive can fail and his data will not be lost. The drives that I chose were the Western Digital Red+ 4TB SATA drives which are designed for NAS use. Once the RAID 5 setup was done, it would give him just under 11TB of usable storage. That is almost triple the storage of his old NAS.

Let’s have a look at the back of the NAS:

On the left side you get a reset button, Two gigabit Ethernet ports (for redundancy, bonding to get extra speed, or both), an eSATA connector and a connector for power. On the right is a USB 3.0 port as well as a security lock port. The dual fans is a nice touch as it will ensure that they whole thing stays cool. And from my setup, I really didn’t hear the fans at all. Now let’s have a look underneath the NAS:

It also has two built-in M.2 SSD slots for cache acceleration. Meaning that you can increase the performance of the NAS by going out and buying a pair of M.2 SSDs.

Included in the box are a pair of Ethernet cables, the power adapter, and four trays for 3.5″ and 2.5″ hard drives (the latter requires screws which are included, the former can be mounted directly into the trays without screws).

In terms of hardware, The DS920+ is powered by a quad-core 2GHz Intel Celeron J4125 processor and has 4 gigabytes (GB) of DDR4 RAM that can be expanded to 8GB, and the NAS itself can be further expanded to 144TB using a Synology DX517 Expansion Unit. The DS920+ supports the Btrfs and ext4 file systems and offers several RAID types, including Synology Hybrid RAID (SHR), Basic, JBOD, RAID 0, RAID 1, RAID 5, RAID 6, and RAID 10. It natively supports Microsoft Windows clients via SMB, and Macs via SMB and AFS.

Setup was insanely easy:

  • I first put the drives into the trays which was a quick and toolless operation. That took 5 minutes.
  • I put the trays into the NAS. That took 1 minute.
  • I powered it on and was greeted with a setup wizard that guided me through the initial setup and the creation of an administrator account. One nice touch is that it forces you to not use the words “admin”, “administrator” or “root” as the name of the account. It also forces you to create a reasonably strong password. That took 5 minutes.
  • It installed some updates then rebooted. Then I was able to set it up for RAID 5. That took just over 6 hours.
  • Finally, I had to update the version of DSM which is the operating system that the NAS uses. That took 15 minutes.

Done. Declare victory and have a beer.

One last thing that I did was to run the Security Advisor which directed me to address a number of security related issues. I like this because it ensure that your new NAS doesn’t get pwned by a threat actor. Be it an internal threat actor or an external one.

Before I handed this over to the client, I did some testing. To test NAS file transfer performance, I transferred a 5GB folder containing a mix of video, photo, music, and office document files between the NAS and a Mac and timed the read and write speeds. The DS920+ turned in a respectable score of 85 MBps on the write test which is in line with most of its competition.

So do I have any cons about this NAS? The one thing that I think Synology took a swing and a miss on is the fact that they have gigabit Ethernet ports on this NAS. That is a bit of a #fail as in 2022 as I believe that all NAS products should have multi-gigabit Ethernet such as 2.5 Gbps Ethernet. I am guessing that Synology did this to hit a price point which is unfortunate. But for this client’s use case it won’t matter.

Speaking of price, this NAS was $739.00 CDN which isn’t exactly cheap. The 4TB Western Digital Red+ drives were $104.99 CDN each. That totals $1158.96 for this setup. Again, that’s not cheap, but for this client’s use case, it’s perfect for him. And if you need a four bay NAS, I think that this will fit your needs as well.

Leave a comment »