Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

101–110 of 701 posts

Re: WD My Book users wake up to find their data deleted

#101

Post by gruez »

haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

>Very interested to see what the root cause ends up being

The article says:

>Multiple users reported that the data loss coincided with a factory reset that was performed on their devices. One person posted a log that showed unexplained behavior occurring on Wednesday:

I'm leaning more towards 0day than "software bug", mainly because I can't really think of a reason why a bug would cause the factory reset to get triggered, but I can think of plenty of ways an internet connected NAS can be exploited.

Re: WD My Book users wake up to find their data deleted

#102

Post by gruez »

WalterBright wrote: post #80
xoa wrote: post #59

Earlier quoted context omitted.

> Cloud backup is a stupid idea WHAT!? How the heck did you get that conclusion from this story? These are literally your people, who backed up to a local device and essentially chose their own local NAS rather then the cloud. Which unfortunately for them came from a company with bad support that dropped it 6 years ago and likely did a shitty job even before that. But not everyone can be a tech person! Even tech peop…

They hooked the backup to the internet. Not a good idea. Nothing connected to the internet is secure, especially since nothing comes with physical write-enable switches.

So all your data is stored offline and (presumably) on-prem? What if there's a fire?

Re: WD My Book users wake up to find their data deleted

#103

Post by glenneroo »

WalterBright wrote: post #88
glenneroo wrote: post #71

Earlier quoted context omitted.

Good luck getting them to a) admit they have it and b) send you a copy ;)

As a taxpayer, aren't I entitled to a restore? :-)

I know you're joking but to stay on topic, you still have to even get them to even admit they have your data, since it's supposedly illegal. Thanks to Snowden we know, but even in light of those leaks, they have and will probably continue to lie during Senate/Congressional hearings. Once we get past that hurdle, then we can talk about restoring your illegally captured data ;)

Re: WD My Book users wake up to find their data deleted

#104

Post by xoa »

WalterBright wrote: post #80
xoa wrote: post #59

Earlier quoted context omitted.

> Cloud backup is a stupid idea WHAT!? How the heck did you get that conclusion from this story? These are literally your people, who backed up to a local device and essentially chose their own local NAS rather then the cloud. Which unfortunately for them came from a company with bad support that dropped it 6 years ago and likely did a shitty job even before that. But not everyone can be a tech person! Even tech peop…

They hooked the backup to the internet. Not a good idea. Nothing connected to the internet is secure, especially since nothing comes with physical write-enable switches.

Incredibly shallow and dangerously bad hot take. I think you have a very poor understanding of what "security" is, nor the concept of backups in general which necessarily (like security) have a very strong human factors requirement. A backup which is too much of a PITA and requires nearly any level of manual effort simply isn't going to get used much or maintained well at all by the vast majority of the population. Tools and systems exist to serve humanity, not the other way around, and when a system fails badly for many it's not humanity that must all change, it's a shitty system.

Fact: if these people had been running to a decent cloud service, they'd probably still have their data. Really "don't connect backup to the internet" is like, fractally stupid. The more one digs the more stupid angles turn up recursively similar to higher level stupid. "Don't connect backup to the internet" means what to you? What about the computer itself making the backup? If that is connected it could get infected as well, now what? Everyone is just supposed to give up on all networks entirely because "hurr durr nothing on a network is secure"? Which is wrong anyway since security an economic equation, not some ethereal absolute. I hope you never give this advice to anyone IRL.

Re: WD My Book users wake up to find their data deleted

#106

Post by ianmf »

ineedasername wrote: post #65

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors". I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't ex…

These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.

Re: WD My Book users wake up to find their data deleted

#107

Post by pkaye »

beerandt wrote: post #76
function_seven wrote: post #9

It may sound a little unfair, but the MyBook has been on my personal Ban List for 14 years now. (has it been that long ?) I don't know if they still do this, but there was a time their NAS would refuse to allow access to MP3 files over a network. To fight piracy. https://www.theregister.com/2007/12/07/western_digital_drm_c... (Was www.wired.com/2007/12/western-digital)

Maybe the blank CD-R "tax"/ contribution-to-the-riaa didn't have to be paid if it couldn't host media files covered by that agreement? But I have no idea if they would've even had to pay that in the first place on these devices.

This lists several countries with a media tax. I wonder if its still the case.

https://en.wikipedia.org/wiki/Private_copying_levy#Regulatio...

Re: WD My Book users wake up to find their data deleted

#108

Post by physicles »

DaiPlusPlus wrote: post #67
nightfly wrote: post #58

Earlier quoted context omitted.

I backup to cloud (b2, scripts that wrap their CLI tools), but there are lots of reasons to prefer backing up to devices they physically own.

I do both: I backup to my Synology NAS, which then in-turn uses Synology's Hyper-Backup (which is very nice, btw) to my Azure storage account - costs me about $15/mo to store a few terabytes with PITR recovery back to when I started doing this in 2018. The thing is... I can't help but worry someone's going to compromise my NAS and DBAN the drives and then extract the Azure storage key and use that to delete all my ba…

What’s your threat model?

Is there anyone out there with $$$$ who will stop at nothing to part you, a rando, from your old data? Probably not. Are there sophisticated attackers who will burn a couple 0-days to build a botnet for the sole purpose of randsoming NASes AND attached cloud accounts AND the origin systems, accounting for tons of possible configurations? Still pretty unlikely — this is NotPetya level stuff with small payoff.

If you find yourself in the crosshairs of a sophisticated, dedicated attacker (perhaps one in possession of a 0-day), you’re pretty much done. Offline write-only backups stored offsite are the only defense.

However, is there a bug lurking in Hyper-backup that might accidentally wipe stuff from Azure storage, and the bug hits a month before your house gets struck by lightning? Maybe…

Re: WD My Book users wake up to find their data deleted

#109

Post by djrogers »

haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

> I know several people who use these devices because of their simplicity, and they’d be devastated.

I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…

Re: WD My Book users wake up to find their data deleted

#110

Post by userbinator »

ineedasername wrote: post #65

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors". I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't ex…

The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT.

If so, someone simply cracked bad security 6 years out of date and scanned for devices.

Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.

Post reply on HN