Just a warning. It seems there’s a vuln somewhere as my instance of NextCloud got taken over today. My server was locked down already, using SSH keys and NextCloud was up to date. Something has gone through and encrypted everything and asking for crypto to unlock. Luckily I have everything backed u…

Maybe not the best time I updated to NC 17: Following apps have been disabled: deck (incompatible), event_update_notification (incompatible), files_texteditor (incompatible), quota_warning (incompatible), ransomware_detection (incompatible), <--- ransomware_protection (incompatible), <-- …

[image] Paradox55: This implies it’s not a nextcloud issue. This implies we don’t know nothing. And we have to collect more facts and investigate further. Or?

[image] tanghus: Maybe not the best time I updated @tanghus the most important quote and advice so far: :wink: [image] ialexpw: Luckily I have everything backed up, so not a huge deal,

All those have updates. So just upgrade, go to apps and update the apps.

[image] KarlF12: That article on Bleeping Computer sounds as though the ransomware targets client computers running the sync client, rather than the server itself. They probably updated the article and added new information. The ransomware is looking for config/config.php and reads the datadi…

Because it appears the nextcloud team wasn’t contacted at all regarding this issue until after the article went public. Because there are no open github issues related to this under the server branch. Because it appears none of the major nextcloud providers have been hit with it. A random no-name …

This - it was definitely server-side. I had no Windows apps loaded. In response to my earlier comments, as far as I can see it was most likely down to the PHP-FPM CVE with the NGINX config after checking versions. @Paradox55 The URL that was obfuscated is just the index.php file. It was the same fo…

@ialexpw Does your setup show any warnings under Administration > Overview, at https://scan.nextcloud.com/ , or at https://observatory.mozilla.org/ ?

Unfortunately I cannot check it as I no longer have my instance running. I took a snapshot just in case and then destroyed it.

Hmm. Well in any case, I would advise to run all of those tests regularly. I usually do it after each time I update the system which is usually a couple times a month.

Nextcloud community

Nextcry? Encrypted all files through my instance

ℹ️ Support

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled