Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

301–310 of 701 posts

Re: WD My Book users wake up to find their data deleted

#301

Earlier quoted context omitted.

Cloud storage is convenient, as one can then access it from any device. It's great to use as a temporary backup when traveling. But not as a backup strategy.

Why not as a backup strategy? I had my desktop harddrive fail and while I had some local backups but the cloud backup restored me to almost the minute of the failure. The only downside to cloud backup is the slow restore process.

> The only downside to cloud backup

Data theft is another one. Encryption might help, but you have no reasonable way of knowing if the encryption is secure.

Re: WD My Book users wake up to find their data deleted

#302
post #10

My money is on "hardcoded admin backdoor password leaked". Edit: Found the manual[1] "Changing a User’s Password: When viewing details about a user, the Administrator can change the user’s password (no password is the default setting)." Oof. [1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-...

> My money is on "hardcoded admin backdoor

Mine are on UPnP and shitty firmware web server

Re: WD My Book users wake up to find their data deleted

#303

Earlier quoted context omitted.

You forget HGST. They have a longer track record of reliable models than any other manufacturer, even taking the death star into account.

HGST was acquired by WD in 2012 and stopped being a brand altogether in 2018.

> stopped being a brand altogether in 2018.

Unless WD changed their mind again, HGST HDD is still available as of 2021 because customer has been demanding the exact same HDD with exact same model number from the exact same plant. Basically they want to know it is the same old HGST and not WD. And some ( if not most ) of them are large, enterprise customers. So they brought it back in ~2019 (without an announcement).

Re: WD My Book users wake up to find their data deleted

#305

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the CVE, the Overall CVSS Score was only 9.8

That means they were still 0.2 away from the worst possible vulnerability score.

So, on the one hand, Could be worse! On the other hand, there could be a software dev sitting out there thinking "I screwed up big time & didn't even get a perfect score on it. Oh well, better luck next time."

Re: WD My Book users wake up to find their data deleted

#306

Earlier quoted context omitted.

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.

As they should. A drive failing after 12 years is a successful outcome that only 50% of drives reach.

Re: WD My Book users wake up to find their data deleted

#307

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/

curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration

How does one get to resolve /panel/rest/configuration?

Re: WD My Book users wake up to find their data deleted

#308

Earlier quoted context omitted.

It works on your backup drive so when you try to restore from the backup, the ransomware on your system can't encrypt it.

But how do I write backup data to the drive without having to slip a switch every hour?

Verify that your previous backup drive is readable before writing to the next backup drive.

But hey, if you just got a ransomware note, and think "I'm good, I have my backups!", wouldn't you want to flip the read-only switch before plugging in those backup drives? I would. In fact, I'd flip that switch always before trying to read from a backup drive.

Re: WD My Book users wake up to find their data deleted

#309

Earlier quoted context omitted.

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.

They would. But if there was a software vulnerability that would wipe out the hard drives of computers still realistically in use, much past that 3 year agreement expiry? i'd expect them to be on that.

Re: WD My Book users wake up to find their data deleted

#310

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

After using exclusively WD for some decades I've seen the WD Red fiasco[1] and decided to not use WD any more.

[1]: https://blocksandfiles.com/2020/04/14/wd-red-nas-drives-shin...

Post reply on HN