A quick search through Shodan will reveal thousands of unsecured storage devices just sitting open on the internet. I'm really surprised it took this long for something like this to happen.
WD My Book users wake up to find their data deleted
11–20 of 701 posts
Re: WD My Book users wake up to find their data deleted
#12There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet. This is your daily reminder that anything that's connected is not a backup . Yes, that includes the hard drive in your machine. For that matter, RAID is not a backup solution. Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically. That's not backup. And that includ…
> Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically Dropbox allows you to roll back changes and undelete files https://www.dropbox.com/features/cloud-storage/file-recovery...
...if you pay for it, and if your account doesn't get hacked, and if nothing goes wrong on Dropbox's side, and...
That's to say, Dropbox is not a backup.
Re: WD My Book users wake up to find their data deleted
#13Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…
I've never tried FreeNAS, but am surprised it took so much maintenance. I've been using FreeBSD with an HP Microserver and ZFS for the same purpose for about 10 years. I just install the updates and everything just works. Curious what kind of maintenance is taking up your time?
Re: WD My Book users wake up to find their data deleted
#14There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet. This is your daily reminder that anything that's connected is not a backup . Yes, that includes the hard drive in your machine. For that matter, RAID is not a backup solution. Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically. That's not backup. And that includ…
A Copy-On-Write Append-Only system CAN be a backup, even if connected. But that takes a lot more storage space, so it's more expensive.
I wouldn't call it a backup without further clarifications. Like, if it can be killed by the same power surge that takes your main server out, I wouldn't call it a backup.
There are a lot of ways to introduce redundancy in the system that would make backups needed much less frequently (if ever).
But what a backup does is it allows you to have your data in case your system and accounts are compromised, whether through a misuse, failure, or an attack vector.
Re: WD My Book users wake up to find their data deleted
#15My money is on "hardcoded admin backdoor password leaked". Edit: Found the manual[1] "Changing a User’s Password: When viewing details about a user, the Administrator can change the user’s password (no password is the default setting)." Oof. [1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-...
Alternatively - a backdoor without any authentication requirements at all was discovered.
There have been times when web crawlers have found pages with delete icons on them that are pointing to GET requests and, after dutifully following them to index the data, resulted in a server being wiped.
Re: WD My Book users wake up to find their data deleted
#16I used to have one of those, and it bricked after a power outage. Luckly it only contained media I could download again. I opened it to try recovering my files from its HDD directly, but to my surprise it merges the HDD with a portion of internal flash in a single volume. I didn't try recovering it further because I didn't care of the data, but I was really expecting to see my files in that HDD... After that I ditched its mother board and connected its HDD to a raspberry pi.
Re: WD My Book users wake up to find their data deleted
#17It may sound a little unfair, but the MyBook has been on my personal Ban List for 14 years now. (has it been that long ?) I don't know if they still do this, but there was a time their NAS would refuse to allow access to MP3 files over a network. To fight piracy. https://www.theregister.com/2007/12/07/western_digital_drm_c... (Was www.wired.com/2007/12/western-digital)
Ironically, story is posted on a paywall site :)
Re: WD My Book users wake up to find their data deleted
#18Sounds like its affecting people using the My Book live service to access it over the internet Just wow though... Hopefully its not actually doing something like overwriting the data with random bits and just deleting the pointers to the file in the MFT. If the latter case, the data can be easily recovered
I would hope (but I do not expect) Western Digital to recover the data for the end users. This is a really bad situation for some.
The article mentions that a factory reset was performed on the devices. Factory resets usually leave the data in a readable state depending on how paranoid the developers coding them are - you're not usually going to run shred -n 11
Re: WD My Book users wake up to find their data deleted
#19There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet. This is your daily reminder that anything that's connected is not a backup . Yes, that includes the hard drive in your machine. For that matter, RAID is not a backup solution. Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically. That's not backup. And that includ…
> Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically Dropbox allows you to roll back changes and undelete files https://www.dropbox.com/features/cloud-storage/file-recovery...
You know, Dropbox functions in part on the assumption that users act independently. I wonder if they can tell, and if so what happens, if a vendor bug like the one in the article cause a large fraction of users to take the same action simultaneously.
Re: WD My Book users wake up to find their data deleted
#20Earlier quoted context omitted.
> Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically Dropbox allows you to roll back changes and undelete files https://www.dropbox.com/features/cloud-storage/file-recovery...
...if you pay for it, and if your account doesn't get hacked, and if nothing goes wrong on Dropbox's side, and... That's to say, Dropbox is not a backup .
I don't know if this has gone to court yet - but I'd assume that if Dropbox does a thing to delete a bunch of data that causes you a great loss of value when you're paying them specifically to store a bunch of data - then there would be enough of an implied contract in place that you could extract a bunch of pain from them regardless of what their TOS tries to say.
The law is complicated and the details are extremely important - but intent is a pretty big factor.
Also - I'd strongly advise someone who is deciding between buying an external hard drive or using a third party for backup to use the third party. There are definitely risks that remain, but their SLA is likely going to end up being a lot stronger than your hard drive's reliability.