January 5, 20224 yr Unfortunately last night my server was hacked, primarily my media folder. All my movies and tv shows are encrypted with some '0XXX virus' and they left txt. files demanding 300USD ransom for the files. Yeah nah I'm not paying. Id much rather wipe my drives and start fresh with a huge amount of time and effort spent on securing the living crap out of it. I'm not 100% sure how they got in, however I have disabled all portforwarding and taken my server offline. Im wondering if the best option is to wipe and start fresh, if so, how do i go about doing that, I'm struggling to find any clear instructions on reformating Unraid. Is there any possible way of unencrypting the files myself? Lucky i have nothing personal on there and i can reupload most of my movies anyway. I'm quite new to this world and I appreciate any advise anyone can give. Let me know if theres any extra info needed to make sense of this mess... so dissapointing. thanks,
January 5, 20224 yr The first thing to do would be to understand how this happened and make sure it cannot happen again. You should start there :
January 5, 20224 yr 2 hours ago, PhilthyHabits said: however I have disabled all portforwarding and taken my server offline. Sry for not answering your question but as ChatNoir says it's important to first find out HOW this did happen. What ports did you have forwarded? I have not a single port forwarded but when I need to access my server from the internet I use VPN for it.
January 5, 20224 yr Community Expert Remember if you have a SMB user (say, on a Windows Computer) with read/write permissions to that share, then that computer was probably inflected by one of the Ramsomware malware attacks. (IF you are not familiar with Ramsomware attacks just Google about them!) If you have multiple computers accessing that media share, make sure that only computers that absolutely need write access to that share have that privilege. In fact, you could manually turn off the write access for those computers when they don't need to write. If you are not familiar with how to set up SMB security, read here: https://forums.unraid.net/topic/110580-security-is-not-a-dirty-word-unraid-windows-10-smb-setup/?tab=comments#comment-1009109
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.