Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

351–360 of 701 posts

Re: WD My Book users wake up to find their data deleted

#351

Post by [deleted] »

tamlin wrote: post #298
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Typically when building a device like this you get a version of Linux / embedded-OS from the SoC vendor and you are stuck with it because SoC vendor doesn't provide docs that would allow drivers to be maintained. This makes ongoing support harder than it might otherwise be.

[deleted]

Re: WD My Book users wake up to find their data deleted

#352

Post by O_H_E »

WalterBright wrote: post #301
wvenable wrote: post #40

Earlier quoted context omitted.

Why not as a backup strategy? I had my desktop harddrive fail and while I had some local backups but the cloud backup restored me to almost the minute of the failure. The only downside to cloud backup is the slow restore process.

> The only downside to cloud backup Data theft is another one. Encryption might help, but you have no reasonable way of knowing if the encryption is secure.

Encrypt locally before cloud?

Re: WD My Book users wake up to find their data deleted

#354

Post by noja »

fistynuts wrote: post #324
ksec wrote: post #296

Earlier quoted context omitted.

And of course Qnap in the recent month. It keeps repeating, and keeps happening, and some ( me ) keep ranting about it and no one / company is doing anything much with it. Majority of people buy NAS only use it to access their Data within their internal network. But somehow they all include Internet / Cloud features as upsell.

To be fair to Qnap, they're actively patching these issues as they come up. Of course the issues shouldn't be there in the first place, but it's not like they're ignoring the problem.

> To be fair to Qnap, they're actively patching these issues as they come up.

What? They backdoored every device.

Re: WD My Book users wake up to find their data deleted

#355

Post by MattGaiser »

goatinaboat wrote: post #240
thrdbndndn wrote: post #222

Earlier quoted context omitted.

>should end with the culprit being out of business I would agree if it's non-EoL products. This, not so much. Don't get me wrong, I'm not trying to say since it's EoL WD don't need to do anything. Just that the degree of seriousness of this incident changes with that.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

> They made it, they support it as long as any customer still has it.

I am sure there are Windows NT machines still in service. I think my Dad has one in his basement. Should Windows forever support NT?

Re: WD My Book users wake up to find their data deleted

#357

Post by romwell »

3np wrote: post #84
romwell wrote: post #14

Earlier quoted context omitted.

I wouldn't call it a backup without further clarifications. Like, if it can be killed by the same power surge that takes your main server out, I wouldn't call it a backup . There are a lot of ways to introduce redundancy in the system that would make backups needed much less frequently (if ever). But what a backup does is it allows you to have your data in case your system and accounts are compromised , whether throu…

I was with you through the rest of the thread until here, but this is too extreme. By your definition there does not exist such a thing as an in-site backup, does there? Take it to the extreme and everything is connected somehow at some point, thereby making a True Backup by your definition physically impossible, even off-site. The point where the backup is made could have a zero-day propagate to the tape machine, ki…

Well, as long as you can recover from an onsite backup after logging into your system and completely destroying everything you can, it counts.

An incremental snapshot to a remote is as good as a backup as WD users just found out.

>The point where the backup is made could have a zero-day propagate to the tape machine

Again, the point here is the failure of the backup is decoupled from the failure of your system.

Again, everything is on a spectrum, and we can argue about definitions, however, a copy on a hard drive that's sitting on your bookshelf is decoupled from whatever happens to your computer unless both get destroyed (or stolen) - and that's how good that backup solution is.

The data on a RAID array will go poof if you accidentally rm -rf that partition, so the chances of it failing when the system fails are very high. Hence it's an awful backup solution.

What you have to consider is not whether the chances of failure are high or low, but where the chances of failure of both the system and the backup at the same time are non-negligible.

Re: WD My Book users wake up to find their data deleted

#358

Post by romwell »

3np wrote: post #84
romwell wrote: post #14

Earlier quoted context omitted.

I wouldn't call it a backup without further clarifications. Like, if it can be killed by the same power surge that takes your main server out, I wouldn't call it a backup . There are a lot of ways to introduce redundancy in the system that would make backups needed much less frequently (if ever). But what a backup does is it allows you to have your data in case your system and accounts are compromised , whether throu…

I was with you through the rest of the thread until here, but this is too extreme. By your definition there does not exist such a thing as an in-site backup, does there? Take it to the extreme and everything is connected somehow at some point, thereby making a True Backup by your definition physically impossible, even off-site. The point where the backup is made could have a zero-day propagate to the tape machine, ki…

Well, as long as you can recover from an onsite backup after logging into your system and completely destroying everything you can, it counts.

An incremental snapshot to a remote is as good as a backup as WD users just found out.

>The point where the backup is made could have a zero-day propagate to the tape machine

Again, the point here is the failure of the backup is decoupled from the failure of your system.

Again, everything is on a spectrum, and we can argue about definitions, however, a copy on a hard drive that's sitting on your bookshelf is decoupled from whatever happens to your computer unless both get destroyed (or stolen) - and that's how good that backup solution is.

The data on a RAID array will go poof if you accidentally rm -rf that partition, so the chances of it failing when the system fails are very high. Hence it's an awful backup solution.

What you have to consider is not whether the chances of failure are high or low, but where the chances of failure of both the system and the backup at the same time are non-negligible.p

Re: WD My Book users wake up to find their data deleted

#359

Post by Erwin »

msravi wrote: post #307
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?

curl has a handy --resolve option for telling it how to resolve certain names. Useful when you want to connect to something that thinks it's foo.bar.com and send the right tls/host, but DNS doesn't have it correct yet

Re: WD My Book users wake up to find their data deleted

#360

Post by bartvk »

mpol wrote: post #232
jxramos wrote: post #39

Earlier quoted context omitted.

do you know of any tools for consistency/accuracy? I've been meaning to do some basic md5 checks for all my files but haven't gotten around to it. Every now and then I find a corrupt jpg image that has a rectangular band running through it or something of the like.

For all my important photos I use par files. Using command-line tools like par2create and par2repair is simply part of the routine of storing photos from the camera on the NAS. I also use it for music files, in the past too many mp3s got broken.

Yup, I also do this. Photos get moved into monthly folders, and every now and then, I run "par2create par2file *".

Before I did this, in the past, I restored from backup and found I had damaged jpeg files. With par2, there's at least a recourse.

Post reply on HN