Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

271–280 of 701 posts

Re: WD My Book users wake up to find their data deleted

#271

Post by andi999 »

zamadatix wrote: post #255
busymom0 wrote: post #220

Earlier quoted context omitted.

I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.

There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a prece…

EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.

Re: WD My Book users wake up to find their data deleted

#272

Post by Pxtl »

I wonder how this happened. I mean, most of these devices are going to be behind NAT, which isn't perfect security but does mean the device has to basically go looking for trouble to get hacked.

I mean theoretically a vulnerable device on your network that doesn't actively seek out connections is risky but it shouldnt see this kind of total across the world compromise.

Re: WD My Book users wake up to find their data deleted

#273

Post by CrendKing »

xvector wrote: post #233
xyzzy123 wrote: post #214

Earlier quoted context omitted.

This has never happened before and could seriously ruin the brand. [EDIT: widespread, very public data loss with a remote cause, as a result of a firmware vulnerability in a product whose job is to store data]

I hope it ruins the brand. This sort of incompetence and gross negligence ought to cripple companies.

If WD is gone, are you going to buy drives from Seagate, seriously? I've had 3 hard drives from Seagate just fail by itself before, 0 from WD so far. HGST used to be good, but sold to WD. I have no experience with Toshiba, but they have less product diversity and higher price.

Re: WD My Book users wake up to find their data deleted

#274

Post by MattGaiser »

sellyme wrote: post #266
MattGaiser wrote: post #210

Earlier quoted context omitted.

Does it come with any guarantees of lifetime for those patches though? Is there any reason that Apple can’t drop support in two years?

>Does it come with any guarantees of lifetime for those patches though? This guarantee is called "consumer law". The requirement of a patch means that the product you paid for was broken. So yes, they absolutely have a legal requirement to fix that (or refund your purchase), and compensate for any damages that their broken product caused you. Not that this is enforced particularly often, but given Apple's ubiquity an…

But lifetime is evidently not as long as the device lasts, as we see with Microsoft. Plenty of XP machines are still alive out there and they have long been out of support. So while Apple does provide a lot of support for older devices seemingly, how much are they legally/contractually required to provide currently?

Re: WD My Book users wake up to find their data deleted

#275

Post by WalterBright »

exporectomy wrote: post #83
WalterBright wrote: post #23

> “It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user,” one user wrote. I'll say again: backup drives must have a physical write enable switch on them. To all the people who argue against this - just you wait till it happens to you! Not having multiple backups is also a very bad idea. One day my 8T drive slipped out of my hand and smacked…

My backup drive has a physical switch. I used to be meticulous in setting it to read-only except while making a backup. But now I just leave it in read/write mode because I lost my enthusiasm. It's not plugged in when not in use though, so it's a bit safer from this sort of thing. How would you do automated backups with a physical switch? Are you proposing nobody does automated daily or more frequent backups?

I suggest rolling backups. Tapes are also a possibility, as they can be written in append-only mode.

Just remember that ransomware will encrypt any drive you hook up to it, including your backup drives. A physical write-enable will prevent that, and it should be disabled anytime you are restoring from backup.

I want a write-enable switch even for simple tasks like copying one drive to another, just so I don't mistakenly copy the wrong direction.

Re: WD My Book users wake up to find their data deleted

#276

Post by SOMA_BOFH »

djrogers wrote: post #109
haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

> I know several people who use these devices because of their simplicity, and they’d be devastated. I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…

tell that to grandma who just wants to store her family photos. imagine if this mindset was extended to automobiles.

Re: WD My Book users wake up to find their data deleted

#278

Post by ChuckMcM »

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet.

I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to affirmatively indicate that you know it is no longer supported and any further use comes at your own risk.

It is also another great case study for open source NAS devices, like the TrueNAS line, that you can patch even if iXSystems goes away.

Re: WD My Book users wake up to find their data deleted

#279

Post by cortesoft »

WalterBright wrote: post #242
cortesoft wrote: post #180

Earlier quoted context omitted.

A physical write enable switch? My computer is doing automatic hourly backups, how is that going to work?

It works on your backup drive so when you try to restore from the backup, the ransomware on your system can't encrypt it.

But how do I write backup data to the drive without having to slip a switch every hour?
Post reply on HN