Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

331–340 of 701 posts

Re: WD My Book users wake up to find their data deleted

#331

Post by ineedasername »

IncRnd wrote: post #236
WalterBright wrote: post #160

Earlier quoted context omitted.

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.

In this particular case, there were My Book drives and My Book Live. When the Live part was configured, you would be creating an entry-point into your network for WD to run code on your drive. I know this, because I purchased one, and read the small getting started guide that came with it. Needless to say, I never ran any of the Live code. Several of these sorts of things have come up in the industry that always made…

The CVE says it needs the IP address. How did the entry point work? Unless it was something like NAT port-forwarding I don't know how the attack could punch through to whatever port the device was using to expose the API.

Re: WD My Book users wake up to find their data deleted

#332

Post by jl6 »

jimmyswimmy wrote: post #261
goatinaboat wrote: post #240

Earlier quoted context omitted.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

I can't agree strongly enough with you, though I'm not sure about the term you recommend. On the one hand, imagine if your car were end of lifed after a couple years. On the other hand, imagine if it took 20 years. The first would ensure you are screwed, the latter would encourage serial corporate bankruptcy. There's a good middle ground. Perhaps, like the 10 years for cars, it needs to be legislated. Perhaps this is…

Remember a car costs about 100x as much as a hard drive so probably should be expected to last much longer.

Re: WD My Book users wake up to find their data deleted

#333

Post by SilverRed »

ksec wrote: post #315
WantonQuantum wrote: post #203

Earlier quoted context omitted.

The iPhone I’m writing this on is several years old and fully patched. I don’t pay a subscription to Apple for the phone.

iOS is only something like 5 years support ( Which is great ). My Book Live goes as far back as 2011. I am pretty sure no security update are being provided to iPhone 4s.

They are still pushing security patches for ios 12 which is older than 5 years. I doubt there are many iphone 4s users left at all since most apps won't work.

Re: WD My Book users wake up to find their data deleted

#334

Post by rawoke083600 »

technion wrote: post #127
nneonneo wrote: post #124

Earlier quoted context omitted.

Wow. Back door accounts are just totally inexcusable these days - manufacturers should be held to account if their back doors end up getting exploited by threat actors. (Granted, you could argue it’s hard to distinguish between a really terrible bug and a back door, sometimes, but “intent” should cover this difference…) Would you happen to have a write up/article about this series of events that isn’t a sanitized ser…

Try this: https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450...

Wow !

Re: WD My Book users wake up to find their data deleted

#335

Post by ineedasername »

nhoughto wrote: post #131
bigiain wrote: post #123

"The My Book Live device received its final firmware update in 2015." A unpatched in 6 years linux device directly connected to the internet? What could possibly go wrong? "There is no IoT, there is only the internet of unpatched linux boxes."

doesn't appear to be a directly connected to the internet problem, even NAT'd stuff wiped data.

How did that work unless there was port forwarding?

Re: WD My Book users wake up to find their data deleted

#336

Post by pessimizer »

SOMA_BOFH wrote: post #270
ghostly_s wrote: post #196

Earlier quoted context omitted.

Non-technical users don't care about this distinction. The name Western Digital is on both, and that name's brand value is destroyed forever if this indeed turns out to be irreversible. Though they could probably pivot to selling their drives in other's NAS devices without much difficulty if they want to remain in this market.

they said the same thing about tylenol in 1982.

Somebody actually poisoned Tylenol. People realize that all the food they eat could have been poisoned in the grocery store. There's no easy mapping to "every external hard drive manufacturer could stop updating their products and your data could spontaneously delete itself."

Re: WD My Book users wake up to find their data deleted

#337

Post by SilverRed »

emodendroket wrote: post #185
MattGaiser wrote: post #184

Earlier quoted context omitted.

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

If I'm going to pay a subscription fee, why am I even bothering with an on-premise solution really.

There is no reason. It's even hard to justify non iot drives when you consider having to buy drives for backups and maintain those backups. The cloud options just come out really good value.

I keep hard drives around for data I don't care about like games and movies but my personal data like photos is all in the cloud and it costs me next to nothing to store it.

Re: WD My Book users wake up to find their data deleted

#338

Post by SilverRed »

bigiain wrote: post #130
WalterBright wrote: post #38

Earlier quoted context omitted.

> cloud backups are likely going to be more reliable I've seen enough HackerNews articles: 1. My account got deleted and I can't find a human to talk to and all my pictures going back 20 years are gone! 2. A hacker guessed my password and deleted my online presence! It's all gone! 3. My storage provider went bust and all my stuff is gone!

Backblaze's latest drive report shows an annual failure rate for hard drives of 0.85%. I very strongly suspect the total of all failures of the type you're listing there is many orders of magnitude lower than that across all cloud storage users. If you care about your backups, a single cloud vendor/account vanishing isn't going to be a problem, in exactly the same way that if you care about your backups,m a single dr…

I have found that filesystem corruption or accidental deletion is far more common than physical drive failure.

Re: WD My Book users wake up to find their data deleted

#339

Post by raverbashing »

djrogers wrote: post #109
haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

> I know several people who use these devices because of their simplicity, and they’d be devastated. I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…

I can't imagine a scenario where people assume an 8 y.o. device is automatically trash, only because it's old.

I'm typing this on a 10 y.o. laptop. It still works. Sure, the manufacturer and browser vendor released updates, but it wouldn't be too out of the ordinary if it didn't.

That being said, I think its predecessor would still work (for posting a comment to HN at least)

Re: WD My Book users wake up to find their data deleted

#340

Post by romwell »

SAI_Peregrinus wrote: post #74
romwell wrote: post #60

Earlier quoted context omitted.

I agree with what you say, I'm just nitpicking on differentiating redundancy from backups . Yes, a building with tapes can burn down. But whether it does so or not is not correlated with the state of the system that the original data lives on. Redundancy is a great step to prevent data loss. But redundancy won't do what a backup would: keep your data safe even if your system is fucked . Cloud sync is a double-edged s…

I'd say there's an even better distinction: backups keep your data safe even if you manually delete it . With only redundancy if you delete a file it's gone. With a backup, it's still in the last backup. Of course there's usually some maximum retention period for backups, but that can get quite long. Everything else is secondary and can be covered by both. The chance of your redundant data center burning down at the…

I agree, and I'll stick with this one :) Nobody can mess up your system better than you can anyway.
Post reply on HN