Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

221–230 of 701 posts

Re: WD My Book users wake up to find their data deleted

#221

Post by thebean11 »

gruez wrote: post #198
cmeacham98 wrote: post #194

Earlier quoted context omitted.

Seriously? What's the point of owning the hardware then, might as well just use Dropbox? Seems like you take on all the risk for essentially no benefit.

>What's the point of owning the hardware then, might as well just use Dropbox? Seems like you take on all the risk for essentially no benefit. Dropbox costs $120/year for 2TB. WD live looks to be a one time purchase price for however many terabytes you want.

Hard drives are consumable devices. Dropbox sounds like a better deal considering you get redundancy, don’t need to replace drives when they fail, can recover deleted files for some amount of time (I think)..

Re: WD My Book users wake up to find their data deleted

#222

Post by thrdbndndn »

rantwasp wrote: post #211

Can't wait for my 3$ as compensation for losing all the data. Seriously now. A class action lawsuit should end with the culprit being out of business in cases of extreme negligence like this one. Anything less just incentivizes them to weight "risk/benefit" of not doing anything

>should end with the culprit being out of business

I would agree if it's non-EoL products. This, not so much.

Don't get me wrong, I'm not trying to say since it's EoL WD don't need to do anything. Just that the degree of seriousness of this incident changes with that.

Re: WD My Book users wake up to find their data deleted

#223

Post by bigiain »

biglost wrote: post #202
bigiain wrote: post #189

Earlier quoted context omitted.

How good do you reckon a 6 years past EOL consumer linux device's defences against a browser running 3rd (or 1st) party javascript making http requests to http://192.168.0.1..254]/cgi-bin/factoryRestore.sh ? How much would you bet against that being an unauthenticated call or one with leaked hard coded reds?

My Firefox on ios crash with that link

That's kinda surprising it "crashes", but it's also kinda meta code... (and either i typed it or HN's formatter munged it...)

Assume some javascript that loops through:

http://192.168.0.1/cgi-bin/factoryRestore.sh

http://192.168.0.2/cgi-bin/factoryRestore.sh

http://192.168.0.3/cgi-bin/factoryRestore.sh

up to

http://192.168.0.254/cgi-bin/factoryRestore.sh

Those just give connection errors for me, but:

http://192.168.1.1/cgi/ACT_FACTORY_RESET

gives me a 403 Forbidden error, and if there was a known default password to my router - it'd try and do a factory reset on it. (It actually wouldn't, it'd send back a confirmation popup, but...)

Re: WD My Book users wake up to find their data deleted

#224

Post by jordache »

WalterBright wrote: post #23

> “It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user,” one user wrote. I'll say again: backup drives must have a physical write enable switch on them. To all the people who argue against this - just you wait till it happens to you! Not having multiple backups is also a very bad idea. One day my 8T drive slipped out of my hand and smacked…

> Cloud backup is a stupid idea. At any moment it could go dark, and you have no recourse

Home backup is a stupid idea. Any any moment your place could catch fire, and you no recourse.

Re: WD My Book users wake up to find their data deleted

#225

Post by dlsa »

dlsa wrote: post #195

Hmmm. I have one of these drives sitting on my desk. Hasn't been powered up for weeks. Do I disassemble it, take the drive out and grab the data that way or just wait? What are these things formatted as? Schrödinger storage: data is both lost and found. Edit: This isn’t the Live version. I think its going to be in pieces Real Soon.

Some further light reading before I pop the case and possibly discover hardware encryption preventing straightforward usage.

https://github.com/themaddoctor/linux-mybook-tools

Re: WD My Book users wake up to find their data deleted

#227

Post by thrdbndndn »

dikei wrote: post #201
shash wrote: post #183

There’s a difference between MyBook and MyBook Live. The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection. The MyBook is a more normal NAS. Bought one of these for my dad few years ago without noticing the difference. Cheap, hobbled and bricked itself more than once. Even without this i…

I think you are confused between My Book and My Cloud * My Book: An external HDD that's attached to your computer through USB. * My Cloud: A NAS that's connected to your network through Ethernet, support SMB, FTP, NFS. There's also My Cloud Home, which is also a NAS, but you can only access your data through WD proprietary app, not SMB.

Not sure why you're downvoted. What OP said

> The MyBook is a more normal NAS

is totally wrong. MyBook is just an external HDD.

Re: WD My Book users wake up to find their data deleted

#228

Post by nextlevelwizard »

mrtweetyhack wrote: post #154
fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

who else do you go with where you won't run in to the same problem?

As it happens I went with my own solution just yesterday. It has no fancy web UI or app connectivity it is literally a Linux box with SMB share on it.

The drive happens to be Toshiba, but that is just a medium

Re: WD My Book users wake up to find their data deleted

#229

Post by nextlevelwizard »

WalterBright wrote: post #160
fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.

You don’t have that either. Stop the FUD. Just don’t have your only backup be connected to the Internet with remote wipe capabilities

Re: WD My Book users wake up to find their data deleted

#230

Post by monsieurbanana »

bigiain wrote: post #144
majormajor wrote: post #46

Earlier quoted context omitted.

If my cloud backup backend provider cancels my account, my backup software will quickly complain. There will be a window of exposure, but I can act quickly. If my backup harddrive is in the same house as my main storage and my house burns down, I'm fucked. If I'm fancy, I may have multiple backend storage providers, too. Lot easier to do that then to have multiple houses. I wanted to use a safe deposit box in the pas…

"Redundant Array of Inexpensive Cloud Storage Providers is not a backup!!!" (Can we make RAICSP a thing? Or do multi-cloud solution vendors already has a snappy marketing term for storing everything on all of S3, Azure Blob, and Google Storage at once?)

It's not? Why?
Post reply on HN