Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

361–370 of 701 posts

Re: WD My Book users wake up to find their data deleted

#361

Post by tonyedgecombe »

WalterBright wrote: post #160
fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.

You should trust anything connected to the internet.

I presume you mean shouldn't rather than should.

Re: WD My Book users wake up to find their data deleted

#362

Post by hughrr »

karlkloss wrote: post #356

I never trusted commercial NAS, I don't even trust OS NAS distributions, they all have their own problems. Just use standard hardware, a standard Linux distribution, and learn how to configure it. Convenience is always bought with security.

I'm with you on this. I don't run a NAS and never will.

Re: WD My Book users wake up to find their data deleted

#363

Post by slipframe »

bredren wrote: post #343
throwawayboise wrote: post #319

Earlier quoted context omitted.

Suppose there were a vulnerability in Mac OS X Tiger that wiped the hard drive of any G4 Powerbook connected to the internet. Would you expect Apple to be on that?

The company is among the most responsive to security issues because security is directly tied to their core value around data privacy.

From conversations on this website about Apple's responsiveness/attitude to security researchers hunting bounties, I have gotten a contrary impression about Apple.

Re: WD My Book users wake up to find their data deleted

#364

Post by chtitux »

msravi wrote: post #307
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?

curl has a very handy --resolve option for that:

curl --resolve 'panel:443:192.168.10.5' -k -X GET https://panel/rest/configuration

Hostname can be set to * in recent versions of curl, it's even more handy:

curl --resolve '*:443:192.168.10.5' -k -X GET https://panel/rest/configuration

Re: WD My Book users wake up to find their data deleted

#365

Post by bigiain »

monsieurbanana wrote: post #230
bigiain wrote: post #144

Earlier quoted context omitted.

"Redundant Array of Inexpensive Cloud Storage Providers is not a backup!!!" (Can we make RAICSP a thing? Or do multi-cloud solution vendors already has a snappy marketing term for storing everything on all of S3, Azure Blob, and Google Storage at once?)

It's not? Why?

Sorry, just riffing on the “RAID is not a backup” that gets yelled at everybody who ever did an rm -rf on their raid by accident…

Re: WD My Book users wake up to find their data deleted

#366

Post by lrem »

haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

Have you ever found a fix to FreeNAS not knowing how to slow down the fan in the Microserver? Or is your generation free of this issue?

Re: WD My Book users wake up to find their data deleted

#367

Post by slipframe »

nextlevelwizard wrote: post #229
WalterBright wrote: post #160

Earlier quoted context omitted.

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.

You don’t have that either. Stop the FUD. Just don’t have your only backup be connected to the Internet with remote wipe capabilities

How many My Book customers would even understand the meaning of your [correct] advice? When companies fuck people over with a defective product, we should resist the urge to tell the victims to be more tech savvy and not use those sort of products. Particularly when those products are intended for the general public.

Re: WD My Book users wake up to find their data deleted

#368

Post by MattGaiser »

sellyme wrote: post #347
MattGaiser wrote: post #274

Earlier quoted context omitted.

But lifetime is evidently not as long as the device lasts, as we see with Microsoft. Plenty of XP machines are still alive out there and they have long been out of support. So while Apple does provide a lot of support for older devices seemingly, how much are they legally/contractually required to provide currently?

> But lifetime is evidently not as long as the device lasts, as we see with Microsoft. Plenty of XP machines are still alive out there and they have long been out of support. This will vary from jurisdiction to jurisdiction, but where I live, "lifetime" is defined as the period of time in which a product is reasonably expected to last. Talking about "XP machines" is a bit weird, because you're really talking about tw…

A very thoughtful answer. Thank you.

Re: WD My Book users wake up to find their data deleted

#369

Post by Too »

romwell wrote: post #42
nucleardog wrote: post #30

Earlier quoted context omitted.

By that logic _nothing_ is a backup. A disconnected hard-drive could be lost in a fire, theft, physical damage, you could stop paying your rent and your landlord could repossess it... Telling people that any redundant copy that isn't 100% reliable (i.e., everything) isn't a backup is not a good way to get people to take backups.

This is not correct. While a hard-drive could be lost in a fire, etc., the state of availability of the data on it is decoupled from that of the system that has the data that's being backed up. And that's the entire point! Take that as a definition: a backup is a redundant copy whose availability is independent of that of the original . FYI, from one of the comments below: > I've "lost" (had to restore from personal…

How decoupled is decoupled enough though? Does it need to be air-gapped?

You could access your dropbox data from computer B even while it is syncing files from computer A. Together with the 30 day file recovery window, this seems fairly decoupled to me. Assuming that the dropbox file history and the dropbox normal sync is seen as two separate systems.

Now you shouldn't have this as your only backup, but combine it with a second service with similar guarantees and even if you wipe your local drive and the wipe get propagated to dropbox, you are still backed by the 30 day history inside both dropbox and the second service, which are decoupled from each other.

Re: WD My Book users wake up to find their data deleted

#370

Post by code_duck »

throwawayboise wrote: post #297
freeone3000 wrote: post #282

Earlier quoted context omitted.

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.

I have two 2010-11 MacBook Pros that are working perfectly with their original mechanical hard drives. They even still get software updates.
Post reply on HN