General
- Target latest-9.zip
- Size 42.6MB
- Sample260629-w2ly2scs8w
- SHA256 ba9f5d06197f2a7297ac476c49f2a5932bba10791aaee456c2be3a86562a1d22
Score
10/10
Malware Config
Extracted
Ransom Note
- ======================== Encryption Configuration ======================== The primary purpose of the Nextcloud server-side encryption is to protect users' files on remote storage, such as Dropbox and Google Drive, and to do it easily and seamlessly from within Nextcloud. In Nextcloud 9 the server-side encryption separates encryption of local and remote storage. This allows you to encrypt remote storage, such as Dropbox and Google, without having to also encrypt your home storage on your Nextcloud server. .. note:: Starting with Nextcloud 9 we support Authenticated Encryption for all newly encrypted files. See https://hackerone.com/reports/108082 for more technical information about the impact. For maximum security make sure to configure external storage with "Check for changes: Never". This will let Nextcloud ignore new files not added via Nextcloud, so a malicious external storage administrator could not add new files to the storage without your knowledge. Of course, this is not wise if your external storage is subject to legitimate external changes. Nextcloud server-side encryption encrypts files stored on the Nextcloud server, and files on remote storage that is connected to your Nextcloud server. Encryption and decryption are performed on the Nextcloud server. All files sent to remote storage will be encrypted by the Nextcloud server, and upon retrieval, decrypted before serving them to you and anyone you have shared them with. .. note:: Encrypting files increases their size by roughly 35%, so you must take this into account when you are provisioning storage and setting storage quotas. User's quotas are based on the unencrypted file size, and not the encrypted file size. When files on external storage are encrypted in Nextcloud, you cannot share them directly from the external storage services, but only through Nextcloud sharing because the key to decrypt the data never leaves the Nextcloud server. Nextcloud's server-side encryption generates a strong encryption key, which is unlocked by user's passwords. Your users don't need to track an extra password, but simply log in as they normally do. It encrypts only the contents of files, and not filenames and directory structures. You should regularly backup all encryption keys to prevent permanent data loss. The encryption keys are stored in the following directories: ``data/<user>/files_encryption`` Users' private keys and all other keys necessary to decrypt the users' files ``data/files_encryption`` private keys and all other keys necessary to decrypt the files stored on a system wide external storage When encryption is enabled, all files are encrypted and decrypted by the Nextcloud application, and stored encrypted on your remote storage. This protects your data on externally hosted storage. The Nextcloud admin and the storage admin will see only encrypted files when browsing backend storage. .. warning:: Encryption keys are stored only on the Nextcloud server, eliminating exposure of your data to third-party storage providers. The encryption app does **not** protect your data if your Nextcloud server is compromised, and it does not prevent Nextcloud administrators from reading user's files. This would require client-side encryption, which this app does not provide. If your Nextcloud server is not connected to any external storage services then it is better to use other encryption tools, such as file-level or whole-disk encryption. Note also that SSL terminates at or before Apache on the Nextcloud server, and all files will exist in an unencrypted state between the SSL connection termination and the Nextcloud code that encrypts and decrypts files. This is also potentially exploitable by anyone with administrator access to your server. Read `How Nextcloud uses encryption to protect your data <https://owncloud.org/blog/how-owncloud-uses-encryption-to-protect-your- data/>`_ for more information. Before Enabling Encryption -------------------------- Plan very carefully before enabling encryption because it is not reversible via the Nextcloud Web interface. If you lose your encryption keys your files are not recoverable. Always have backups of your encryption keys stored in a safe location, and consider enabling all recovery options. You have more options via the ``occ`` command (see :ref:`occ_encryption_label`) .. _enable_encryption_label: Enabling Encryption ------------------- Nextcloud encryption consists of two parts. The base encryption system is enabled and disabled on your Admin page. First you must enable this, and then select an encryption module to load. Currently the only available encryption module is the Nextcloud Default Encryption Module. First go to the **Server-side encryption** section of your Admin page and check **Enable server-side encryption**. You have one last chance to change your mind. .. figure:: images/encryption3.png After clicking the **Enable Encryption** button you see the message "No encryption module loaded, please load a encryption module in the app menu", so go to your Apps page to enable the Nextcloud Default Encryption Module. .. figure:: images/encryption1.png Return to your Admin page to see the Nextcloud Default Encryption Module added to the module selector, and automatically selected. Now you must log out and then log back in to initialize your encryption keys. .. figure:: images/encryption14.png When you log back in, there is a checkbox for enabling encryption on your home storage. This is checked by default. Un-check to avoid encrypting your home storage. .. figure:: images/encryption15.png Sharing Encrypted Files ----------------------- After encryption is enabled your users must also log out and log back in to generate their personal encryption keys. They will see a yellow warning banner that says "Encryption App is enabled but your keys are not initialized, please log-out and log-in again." Share owners may need to re-share files after encryption is enabled; users trying to access the share will see a message advising them to ask the share owner to re-share the file with them. For individual shares, un-share and re-share the file. For group shares, share with any individuals who can't access the share. This updates the encryption, and then the share owner can remove the individual shares. .. figure:: images/encryption9.png Encrypting External Mountpoints ------------------------------- You and your users can encrypt individual external mountpoints. You must have external storage enabled on your Admin page, and enabled for your users. Encryption settings can be configured in the mount options for an external storage mount, see :ref:`external_storage_mount_options_label` (:doc:`external_storage_configuration_gui`) Enabling Users File Recovery Keys ---------------------------------- If you lose your Nextcloud password, then you lose access to your encrypted files. If one of your users loses their Nextcloud password their files are unrecoverable. You cannot reset their password in the normal way; you'll see a yellow banner warning "Please provide an admin recovery password, otherwise all user data will be lost". To avoid all this, create a Recovery Key. Go to the Encryption section of your Admin page and set a recovery key password. .. figure:: images/encryption10.png Then your users have the option of enabling password recovery on their Personal pages. If they do not do this, then the Recovery Key won't work for them. .. figure:: images/encryption7.png For users who have enabled password recovery, give them a new password and recover access to their encrypted files by supplying the Recovery Key on the Users page. .. figure:: images/encryption8.png You may change your Recovery Key password. .. figure:: images/encryption12.png .. _occ_encryption_label: occ Encryption Commands ----------------------- If you have shell access you may use the ``occ`` command to perform encryption operations, and you have additional options such as decryption and creating a single master encryption key. See :ref:`encryption_label` for detailed instructions on using ``occ``. Get the current status of encryption and the loaded encryption module:: occ encryption:status - enabled: false - defaultModule: OC_DEFAULT_MODULE This is equivalent to checking **Enable server-side encryption** on your Admin page:: occ encryption:enable Encryption enabled Default module: OC_DEFAULT_MODULE List the available encryption modules:: occ encryption:list-modules - OC_DEFAULT_MODULE: Default encryption module [default*] Select a different default Encryption module (currently the only available module is OC_DEFAULT_MODULE):: occ encryption:set-default-module [Module ID]. The [module ID] is taken from the ``encryption:list-modules`` command. Encrypt all data files for all users. For performance reasons, when you enable encryption on a Nextcloud server only new and changed files are encrypted. This command gives you the option to encrypt all files. You must first put your Nextcloud server into single-user mode to prevent any user activity until encryption is completed:: occ maintenance:singleuser --on Single user mode is currently enabled Then run ``occ``:: occ encryption:encrypt-all You are about to start to encrypt all files stored in your Nextcloud. It will depend on the encryption module you use which files get encrypted. Depending on the number and size of your files this can take some time. Please make sure that no users access their files during this process! Do you really want to continue? (y/n) When you type ``y`` it creates a key pair for each of your users, and then encrypts their files, displaying progress until all user files are encrypted. Decrypt all user data files, or optionally a single user:: occ encryption:decrypt-all [username] View current location of keys:: occ encryption:show-key-storage-root Current key storage root: default storage location (data/) Move keys to a different root folder, either locally or on a different server. The folder must already exist, be owned by root and your HTTP group, and be restricted to root and your HTTP group. This example is for Ubuntu Linux. Note that the new folder is relative to your ``occ`` directory:: mkdir /etc/keys chown -R root:www-data /etc/keys chmod -R 0770 /etc/keys occ encryption:change-key-storage-root ../../../etc/keys Start to move keys: 4 [============================] Key storage root successfully changed to ../../../etc/keys Create a new master key. Use this when you have a single-sign on infrastructure. Use this only on fresh installations with no existing data, or on systems where encryption has not already been enabled. It is not possible to disable it:: occ encryption:enable-master-key Disabling Encryption -------------------- You may disable encryption only with ``occ``. Make sure you have backups of all encryption keys, including users'. Put your Nextcloud server into single-user mode, and then disable your encryption module with this command:: occ maintenance:singleuser --on occ encryption:disable Take it out of single-user mode when you are finished:: occ maintenance:singleuser --off Files Not Encrypted ------------------- Only the data in the files in ``data/user/files`` are encrypted, and not the filenames or folder structures. These files are never encrypted: - Existing files in the trash bin & Versions. Only new and changed files after encryption is enabled are encrypted. - Existing files in Versions - Image thumbnails from the Gallery app - Previews from the Files app - The search index from the full text search app - Third-party app data There may be other files that are not encrypted; only files that are exposed to third-party storage providers are guaranteed to be encrypted. LDAP and Other External User Back-ends -------------------------------------- If you use an external user back-end, such as an LDAP or Samba server, and you change a user's password on the back-end, the user will be prompted to change their Nextcloud login to match on their next Nextcloud login. The user will need both their old and new passwords to do this. If you have enabled the Recovery Key then you can change a user's password in the Nextcloud Users panel to match their back-end password, and then, of course, notify the user and give them their new password.
URLs
-
https://hackerone.com/reports/108082
Extracted
Ransom Note
- Table of Contents Nextcloud 9 Server Administration Manual Introduction Nextcloud 9 Release Notes What’s New for Admins in Nextcloud 9 Installation Nextcloud Server Configuration User Management File Sharing and Management File Sharing Configuring Federation Sharing Uploading big files > 512MB Configuring the Collaborative Documents App Providing Default Files Configuring External Storage (GUI) Configuring External Storage (Configuration File) External Storage Authentication mechanisms Encryption Configuration Before Enabling Encryption Enabling Encryption Sharing Encrypted Files Encrypting External Mountpoints Enabling Users File Recovery Keys occ Encryption Commands Disabling Encryption Files Not Encrypted LDAP and Other External User Back-ends Transactional File Locking Previews Configuration Controlling File Versions and Aging Database Configuration Mimetypes Management Maintenance Operations Issues and Troubleshooting « External Stor... Transactional... » Encryption Configuration¶ The primary purpose of the Nextcloud server-side encryption is to protect users’ files on remote storage, such as Dropbox and Google Drive, and to do it easily and seamlessly from within Nextcloud. In Nextcloud 9 the server-side encryption separates encryption of local and remote storage. This allows you to encrypt remote storage, such as Dropbox and Google, without having to also encrypt your home storage on your Nextcloud server. Note Starting with Nextcloud 9 we support Authenticated Encryption for all newly encrypted files. See https://hackerone.com/reports/108082 for more technical information about the impact. For maximum security make sure to configure external storage with “Check for changes: Never”. This will let Nextcloud ignore new files not added via Nextcloud, so a malicious external storage administrator could not add new files to the storage without your knowledge. Of course, this is not wise if your external storage is subject to legitimate external changes. Nextcloud server-side encryption encrypts files stored on the Nextcloud server, and files on remote storage that is connected to your Nextcloud server. Encryption and decryption are performed on the Nextcloud server. All files sent to remote storage will be encrypted by the Nextcloud server, and upon retrieval, decrypted before serving them to you and anyone you have shared them with. Note Encrypting files increases their size by roughly 35%, so you must take this into account when you are provisioning storage and setting storage quotas. User’s quotas are based on the unencrypted file size, and not the encrypted file size. When files on external storage are encrypted in Nextcloud, you cannot share them directly from the external storage services, but only through Nextcloud sharing because the key to decrypt the data never leaves the Nextcloud server. Nextcloud’s server-side encryption generates a strong encryption key, which is unlocked by user’s passwords. Your users don’t need to track an extra password, but simply log in as they normally do. It encrypts only the contents of files, and not filenames and directory structures. You should regularly backup all encryption keys to prevent permanent data loss. The encryption keys are stored in the following directories: data/<user>/files_encryption data/files_encryption When encryption is enabled, all files are encrypted and decrypted by the Nextcloud application, and stored encrypted on your remote storage. This protects your data on externally hosted storage. The Nextcloud admin and the storage admin will see only encrypted files when browsing backend storage. Warning Encryption keys are stored only on the Nextcloud server, eliminating exposure of your data to third-party storage providers. The encryption app does not protect your data if your Nextcloud server is compromised, and it does not prevent Nextcloud administrators from reading user’s files. This would require client-side encryption, which this app does not provide. If your Nextcloud server is not connected to any external storage services then it is better to use other encryption tools, such as file-level or whole-disk encryption. Note also that SSL terminates at or before Apache on the Nextcloud server, and all files will exist in an unencrypted state between the SSL connection termination and the Nextcloud code that encrypts and decrypts files. This is also potentially exploitable by anyone with administrator access to your server. Read How Nextcloud uses encryption to protect your data for more information. Before Enabling Encryption¶ Plan very carefully before enabling encryption because it is not reversible via the Nextcloud Web interface. If you lose your encryption keys your files are not recoverable. Always have backups of your encryption keys stored in a safe location, and consider enabling all recovery options. You have more options via the occ command (see occ Encryption Commands ) Enabling Encryption¶ Nextcloud encryption consists of two parts. The base encryption system is enabled and disabled on your Admin page. First you must enable this, and then select an encryption module to load. Currently the only available encryption module is the Nextcloud Default Encryption Module. First go to the Server-side encryption section of your Admin page and check Enable server-side encryption. You have one last chance to change your mind. After clicking the Enable Encryption button you see the message “No encryption module loaded, please load a encryption module in the app menu”, so go to your Apps page to enable the Nextcloud Default Encryption Module. Return to your Admin page to see the Nextcloud Default Encryption Module added to the module selector, and automatically selected. Now you must log out and then log back in to initialize your encryption keys. When you log back in, there is a checkbox for enabling encryption on your home storage. This is checked by default. Un-check to avoid encrypting your home storage. Sharing Encrypted Files¶ After encryption is enabled your users must also log out and log back in to generate their personal encryption keys. They will see a yellow warning banner that says “Encryption App is enabled but your keys are not initialized, please log-out and log-in again.” Share owners may need to re-share files after encryption is enabled; users trying to access the share will see a message advising them to ask the share owner to re-share the file with them. For individual shares, un-share and re-share the file. For group shares, share with any individuals who can’t access the share. This updates the encryption, and then the share owner can remove the individual shares. Encrypting External Mountpoints¶ You and your users can encrypt individual external mountpoints. You must have external storage enabled on your Admin page, and enabled for your users. Encryption settings can be configured in the mount options for an external storage mount, see Mount Options (Configuring External Storage (GUI)) Enabling Users File Recovery Keys¶ If you lose your Nextcloud password, then you lose access to your encrypted files. If one of your users loses their Nextcloud password their files are unrecoverable. You cannot reset their password in the normal way; you’ll see a yellow banner warning “Please provide an admin recovery password, otherwise all user data will be lost”. To avoid all this, create a Recovery Key. Go to the Encryption section of your Admin page and set a recovery key password. Then your users have the option of enabling password recovery on their Personal pages. If they do not do this, then the Recovery Key won’t work for them. For users who have enabled password recovery, give them a new password and recover access to their encrypted files by supplying the Recovery Key on the Users page. You may change your Recovery Key password. occ Encryption Commands¶ If you have shell access you may use the occ command to perform encryption operations, and you have additional options such as decryption and creating a single master encryption key. See Encryption for detailed instructions on using occ . Get the current status of encryption and the loaded encryption module: This is equivalent to checking Enable server-side encryption on your Admin page: List the available encryption modules: Select a different default Encryption module (currently the only available module is OC_DEFAULT_MODULE): The [module ID] is taken from the encryption:list-modules command. Encrypt all data files for all users. For performance reasons, when you enable encryption on a Nextcloud server only new and changed files are encrypted. This command gives you the option to encrypt all files. You must first put your Nextcloud server into single-user mode to prevent any user activity until encryption is completed: Then run occ : When you type y it creates a key pair for each of your users, and then encrypts their files, displaying progress until all user files are encrypted. Decrypt all user data files, or optionally a single user: View current location of keys: Move keys to a different root folder, either locally or on a different server. The folder must already exist, be owned by root and your HTTP group, and be restricted to root and your HTTP group. This example is for Ubuntu Linux. Note that the new folder is relative to your occ directory: Create a new master key. Use this when you have a single-sign on infrastructure. Use this only on fresh installations with no existing data, or on systems where encryption has not already been enabled. It is not possible to disable it: Disabling Encryption¶ You may disable encryption only with occ . Make sure you have backups of all encryption keys, including users’. Put your Nextcloud server into single-user mode, and then disable your encryption module with this command: Take it out of single-user mode when you are finished: Files Not Encrypted¶ Only the data in the files in data/user/files are encrypted, and not the filenames or folder structures. These files are never encrypted: Existing files in the trash bin & Versions. Only new and changed files after encryption is enabled are encrypted. Existing files in Versions Image thumbnails from the Gallery app Previews from the Files app The search index from the full text search app Third-party app data There may be other files that are not encrypted; only files that are exposed to third-party storage providers are guaranteed to be encrypted. LDAP and Other External User Back-ends¶ If you use an external user back-end, such as an LDAP or Samba server, and you change a user’s password on the back-end, the user will be prompted to change their Nextcloud login to match on their next Nextcloud login. The user will need both their old and new passwords to do this. If you have enabled the Recovery Key then you can change a user’s password in the Nextcloud Users panel to match their back-end password, and then, of course, notify the user and give them their new password. « External Stor... Transactional... »
URLs
-
https://hackerone.com/reports/108082
Targets
-
- Target nextcloud/3rdparty/composer/ClassLoader.php
- Size 12KB
- SHA256 ba40c4e0b003d8175ec8cc1a3aa6728ad24c1fc75a8a12634115262e7f2db271
Score3/10 -
- Target nextcloud/3rdparty/composer/autoload_real.php
- Size 2KB
- SHA256 27680d2ae3724ffc2ab3547a5916b37faa0a8186dbb2171152e41dbc006245ba
Score3/10 -
- Target nextcloud/3rdparty/deepdiver1975/tarstreamer/src/TarStreamer.php
- Size 8KB
- SHA256 039a1ec9d35511218b2a26863e48eb29214caefd8b4ef032209aba2149597a17
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target nextcloud/3rdparty/doctrine/annotations/lib/Doctrine/Common/Annotations/Annotation.php
- Size 2KB
- SHA256 2c18c11c355fcc071ba843b9744f80b7ae0772ce6d456694c45a367a9a9f2cdb
Score3/10 -
- Target nextcloud/3rdparty/doctrine/annotations/lib/Doctrine/Common/Annotations/Annotation/Enum.php
- Size 2KB
- SHA256 ea1cfafb0a138e2fe635a77249c07e64c021260cf860b40c836569cfb0d84387
Score3/10 -
- Target nextcloud/3rdparty/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php
- Size 6KB
- SHA256 2fc2c5b7f03bf12f328441da45be141ec5c9fe403183e37371e9b7d2aebb98b3
Score3/10 -
- Target nextcloud/3rdparty/doctrine/annotations/lib/Doctrine/Common/Annotations/DocParser.php
- Size 37KB
- SHA256 d44583fc8fbbbf0a4d0f5212e6ea880d86c49877d5635cc6f4ae67bb6f91e4a0
Score3/10 -
- Target nextcloud/3rdparty/doctrine/annotations/lib/Doctrine/Common/Annotations/SimpleAnnotationReader.php
- Size 3KB
- SHA256 e9ec07e44598c7822fd5d9510e83f15f0267f77805a1de608e86b74966ca0956
Score3/10 -
- Target nextcloud/3rdparty/doctrine/cache/lib/Doctrine/Common/Cache/CacheProvider.php
- Size 7KB
- SHA256 2ec612cc0f9fbd3be0e428202334fa2901d39a4ab0e67f862416e5d0af0523fb
Score3/10 -
- Target nextcloud/3rdparty/doctrine/cache/lib/Doctrine/Common/Cache/ChainCache.php
- Size 3KB
- SHA256 3526db7695a713b3797ed019ac7003cbaaf4570bf8b6a3e992f451287673c4bc
Score3/10 -
- Target nextcloud/3rdparty/doctrine/cache/lib/Doctrine/Common/Cache/FileCache.php
- Size 8KB
- SHA256 9ab0e25e7833c3d69a68d1926270da8c065406898ee357be5aa88b092c08b505
Score3/10 -
- Target nextcloud/3rdparty/doctrine/cache/lib/Doctrine/Common/Cache/MongoDBCache.php
- Size 5KB
- SHA256 6ecfd99c5f92bcd7f98a51ea7f8e31f578489b7777deb01bdffaec23f5a37ecd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target nextcloud/3rdparty/doctrine/cache/lib/Doctrine/Common/Cache/RiakCache.php
- Size 6KB
- SHA256 8e1f4bea49cc969751eec71947a1481727794aabac6f27c15aab5c0b96f5d807
Score3/10 -
- Target nextcloud/3rdparty/doctrine/collections/lib/Doctrine/Common/Collections/ArrayCollection.php
- Size 7KB
- SHA256 2d22a153af5db6f85ba896c82d88aa69287c31a4fe5ef307fc0d352bf8fdb54a
Score3/10 -
- Target nextcloud/3rdparty/doctrine/collections/lib/Doctrine/Common/Collections/Expr/ClosureExpressionVisitor.php
- Size 7KB
- SHA256 c4dab4d3b79d04258f2b4f5fa8721546744237eb6a5ea02c019291910f277369
Score3/10 -
- Target nextcloud/3rdparty/doctrine/common/lib/Doctrine/Common/Persistence/AbstractManagerRegistry.php
- Size 6KB
- SHA256 cff7eadaad04d7e22a7613b4cb785d953727010c814a49ac1325ce7f893c55ea
Score3/10
MITRE ATT&CK Enterprise v16
Tasks
static1
Score
10/10
behavioral1
Score
3/10
behavioral2
Score
3/10
behavioral3
Score
3/10
behavioral4
Score
3/10
behavioral5
Score
3/10
behavioral6
Score
8/10
behavioral7
Score
3/10
behavioral8
Score
3/10
behavioral9
Score
3/10
behavioral10
Score
3/10
behavioral11
Score
3/10
behavioral12
Score
3/10
behavioral13
Score
3/10
behavioral14
Score
3/10
behavioral15
Score
3/10
behavioral16
Score
3/10
behavioral17
Score
3/10
behavioral18
Score
3/10
behavioral19
Score
3/10
behavioral20
Score
3/10
behavioral21
Score
3/10
behavioral22
Score
3/10
behavioral23
Score
3/10
behavioral24
Score
8/10
behavioral25
Score
3/10
behavioral26
Score
3/10
behavioral27
Score
3/10
behavioral28
Score
3/10
behavioral29
Score
3/10
behavioral30
Score
3/10
behavioral31
Score
3/10
behavioral32
Score
3/10