After upgrading to DSM 7.3.2 and the new encryption key vault, my encrypted volume is now auto-unlocked after a normal reboot (no vault password or recovery key required). It also seems impossible to fully disable the local vault anymore.
In the past, there were public demos showing data access from a powered-off NAS by manipulating the system/reset process and extracting encryption material.
Does anyone know if DSM 7.3.2 actually fixes this class of attacks, or if the new “lock on manual reset” option only mitigates admin-reset scenarios while the vault is still auto-unlocked at boot and potentially exploitable?
From which DSM version did you upgrade to DSM 7.3.2? When I looked into the Synology knowledge base, I could only find a change in behavior for unlocking an encrypted volume in DSM 7.3.0.
Hi Paul, I recall that full volume encryption was introduced in 7.2. It had a major flaw because the data could be accessed with a soft reset.
So in 7.3 a new feature was introduced which erases the vault in case of a soft reset. But the key is still stored on the NAS, so how difficult is it to access it?
There was a previous exploit which managed to do it. SpaceRex mentions it here (7m15s) without giving the details:
