Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

151–160 of 701 posts

Re: WD My Book users wake up to find their data deleted

#151

Post by ExtraE »

Wowfunhappy wrote: post #133
fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

> Why should anyone ever again trust your company to keep their data safe? Because if you need a hard drive, your options are pretty much Western Digital, Seagate, and Toshiba, and they've all had their own problems.

I’m confused by the edit- WD is Western Digital, no?

Re: WD My Book users wake up to find their data deleted

#152

Post by Wowfunhappy »

ExtraE wrote: post #151
Wowfunhappy wrote: post #133

Earlier quoted context omitted.

> Why should anyone ever again trust your company to keep their data safe? Because if you need a hard drive, your options are pretty much Western Digital, Seagate, and Toshiba, and they've all had their own problems.

I’m confused by the edit- WD is Western Digital, no?

Sorry, you caught me before my newer edit. My brain was doing something stupid. (And I need to go to bed.)

Edit: To be clear, it was my mistake, my post made no sense before I fixed it. The parent doesn't deserve the downvotes.

Re: WD My Book users wake up to find their data deleted

#153

Post by gruez »

JKCalhoun wrote: post #118
gruez wrote: post #101

Earlier quoted context omitted.

>Very interested to see what the root cause ends up being The article says: >Multiple users reported that the data loss coincided with a factory reset that was performed on their devices. One person posted a log that showed unexplained behavior occurring on Wednesday: I'm leaning more towards 0day than "software bug", mainly because I can't really think of a reason why a bug would cause the factory reset to get trigg…

> internet connected NAS I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.

>I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.

It's a NAS. Backup isn't the only thing you can do with it. A personal cloud (aka dropbox) is also a valid use case, and requires internet access to work.

Re: WD My Book users wake up to find their data deleted

#154

Post by mrtweetyhack »

fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

who else do you go with where you won't run in to the same problem?

Re: WD My Book users wake up to find their data deleted

#155

Post by ExtraE »

munk-a wrote: post #15
tyingq wrote: post #10

My money is on "hardcoded admin backdoor password leaked". Edit: Found the manual[1] "Changing a User’s Password: When viewing details about a user, the Administrator can change the user’s password (no password is the default setting)." Oof. [1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-...

Alternatively - a backdoor without any authentication requirements at all was discovered. There have been times when web crawlers have found pages with delete icons on them that are pointing to GET requests and, after dutifully following them to index the data, resulted in a server being wiped.

Anyone got a link?

Re: WD My Book users wake up to find their data deleted

#156

Post by earthboundkid »

zenexer wrote: post #140
WalterBright wrote: post #23

> “It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user,” one user wrote. I'll say again: backup drives must have a physical write enable switch on them. To all the people who argue against this - just you wait till it happens to you! Not having multiple backups is also a very bad idea. One day my 8T drive slipped out of my hand and smacked…

Any single backup is a stupid idea. Combine them, and you've got a great backup solution. Why would I keep important data in one physical location? My house could burn down tomorrow, but I'd still have my cloud backups. My cloud backups could roast in a fire tomorrow, but I'd still have my local backups. And probably several other cloud backups. If you put all your eggs in one backup, sooner or later, you're going to…

He only reliable backup mechanism is starting a successful cult whose main tenet is that your data is valuable communication from God, so that they continually duplicate it. Anything else will go bust long, long before the heat death of the universe.

Re: WD My Book users wake up to find their data deleted

#158

Post by haswell »

martyvis wrote: post #138
nhoughto wrote: post #131

Earlier quoted context omitted.

doesn't appear to be a directly connected to the internet problem, even NAT'd stuff wiped data.

By definition "directly connected to the internet" means if a device can on its on accord, direct requests to an entity, ask it a question, and act upon it is true. From what I understand these WD boxes go to a management service in the cloud. and were told they should factory reset. Whether something is pull-only (as in this case) or push (say allows HTTP or SSH access from a random on the internet) is irrelavnt if…

In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall.

For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”

Re: WD My Book users wake up to find their data deleted

#160

Post by WalterBright »

fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.
Post reply on HN