Good. Laypeople need to be weary of IoT crap.
WD My Book users wake up to find their data deleted
281–290 of 701 posts
Re: WD My Book users wake up to find their data deleted
#282According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…
I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.
Re: WD My Book users wake up to find their data deleted
#283Earlier quoted context omitted.
I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.
There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a prece…
> There's really no winning with this.
There is: don't release devices with security flaws in the first place. The fact is, they released a fatally flawed device. That the flaw was discovered later doesn't change that fact.
I think the way we talk about security patches and updates obscures the fact that they're correcting fundamentally flawed software. In other circumstances, this would result in product recalls. Those financial incentives are a big reason why product recalls for serious faults are fairly rare in other types of products.
Re: WD My Book users wake up to find their data deleted
#284Earlier quoted context omitted.
That just effectively means a subscription. So your hard drive will be $100 + $10 a month.
The iPhone I’m writing this on is several years old and fully patched. I don’t pay a subscription to Apple for the phone.
iPhones are subsidized by the App Store revenue.
Re: WD My Book users wake up to find their data deleted
#285> “It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user,” one user wrote. I'll say again: backup drives must have a physical write enable switch on them. To all the people who argue against this - just you wait till it happens to you! Not having multiple backups is also a very bad idea. One day my 8T drive slipped out of my hand and smacked…
> At any moment it could go dark, for any reason, and you have no recourse. I suspect your drive is more likely to die in its own that AWS to fail.
Your faith in the internet doesn't match mine. (Far too many single points of failure.) But suppose you're right. I can buy 10 drives for cheap, but not 10 different cloud accounts.
I also don't care to have the internet snooping on my data. Yes, I know about encryption. Enough to know it cannot be trusted.
Re: WD My Book users wake up to find their data deleted
#286According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…
It's more like a business failure as in the decision to discontinue the devices were taken prematurely.
But really as pointed out above, any IoT device will eventually have a security flaw discovered if updates are stopped.
As a consumer the best bet is to switch to a supported device or disconnect the device from the internet.
Re: WD My Book users wake up to find their data deleted
#287Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…
Qnap had a lot of security issues in the past, like unpatched RCE and backdoors. I wouldn't recommend, (and never ever use qnap cloud or upnp) as it seems they don't really do a good job on software QA or penetration testing or security audits. Hardware is fine but it's much more expensive than just building it yourself.
Some of their hardware is tough to do yourself. e.g. I've got a TL-D800S hooked up to my home server. I know I could build something comparable, but once hardware involves actual "building" rather than just "assembly", it's past the level of effort I want to spend.
Re: WD My Book users wake up to find their data deleted
#288Earlier quoted context omitted.
The issue at hand is a NAS firmware problem, not a HD drive issue. There are quite a few other brands offering NAS devices e.g. Synology, QNAP, Thecus, Pegasus and more.
Public-facing Synology devices got hit in the past too, but they just used it to mine Litecoin. I think someone calculated it and figured out that it cost something like $400k in electricity to mine $100k of coins on the boxes. Aha! It was $600k in dogecoin in 2014 https://www.pcworld.com/article/2364120/hacked-synology-nas-... That’s worth around $125m today (assuming straight hodling).
Synology has a large enough following to get its own ransomware attack (in July 2019) too:
https://www.synology.com/en-us/company/news/article/2019July...
Re: WD My Book users wake up to find their data deleted
#289Earlier quoted context omitted.
> cloud backups are likely going to be more reliable I've seen enough HackerNews articles: 1. My account got deleted and I can't find a human to talk to and all my pictures going back 20 years are gone! 2. A hacker guessed my password and deleted my online presence! It's all gone! 3. My storage provider went bust and all my stuff is gone!
And: 4. My crypto exchange disappeared/went bankrupt/was a scam and now my crypto is all gone. I swear, some people never learn.
not your keys, not your coins. no exceptions.
Re: WD My Book users wake up to find their data deleted
#290There’s a difference between MyBook and MyBook Live. The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection. The MyBook is a more normal NAS. Bought one of these for my dad few years ago without noticing the difference. Cheap, hobbled and bricked itself more than once. Even without this i…
I don’t know where you get this from, but my Live devices all support nfs/smb/ssh. I have both a cloud one and a normal black Live one.