Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

371–380 of 701 posts

Re: WD My Book users wake up to find their data deleted

#371

Post by Algent »

andi999 wrote: post #271
zamadatix wrote: post #255

Earlier quoted context omitted.

There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a prece…

EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.

With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.

Re: WD My Book users wake up to find their data deleted

#372

Post by slipframe »

MattGaiser wrote: post #184
zmmmmm wrote: post #175

Hopefully this flushes out the elephant in the room of the irresponsibility of manufacturers selling devices like this and then leaving the software unpatched / unupdated within a year or two of selling it. Unfortunately this needs to become regulated. Either commit to "lifetime" updates (at least 10 years) or be forced to put a massive warning on the label advising the secure period for which the product can be used…

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

I think we need to lean into the environmental angle to have a chance of addressing this in a better way. Frame this legislation as anti e-waste. Any computer device with an expiration date shorter than 10 years gets a 500% tax, or something like that. I'm just spitballing here but it seems like a surmountable problem to me.

Re: WD My Book users wake up to find their data deleted

#374

Post by ec109685 »

zamadatix wrote: post #255
busymom0 wrote: post #220

Earlier quoted context omitted.

I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.

There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a prece…

Huh. This is a huge security flaw and they decided to not patch it. Winning is patching this.

This is so disingenuous (from the first report of this flaw):

“Western Digital takes the security of our customers’ data seriously, and we provide security updates for our products to address issues from both external reports and regular security audits.”

Re: WD My Book users wake up to find their data deleted

#375

Post by ec109685 »

tamlin wrote: post #298
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Typically when building a device like this you get a version of Linux / embedded-OS from the SoC vendor and you are stuck with it because SoC vendor doesn't provide docs that would allow drivers to be maintained. This makes ongoing support harder than it might otherwise be.

This is a poor call for a network appliance, especially given it can be connected to from the internet.

Re: WD My Book users wake up to find their data deleted

#376

Post by andi999 »

Algent wrote: post #371
andi999 wrote: post #271

Earlier quoted context omitted.

EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.

With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.

You have a Citation? I read 5-7 years.

Re: WD My Book users wake up to find their data deleted

#377

Post by dannyw »

flatiron wrote: post #98
haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

My guess is someone figured out how to bounce commands off WD command server (customer reps helping people reset their devices) and they are spamming customer ids. Either that or these devices have unique ports on the WAN with a 0-day but that would take a lot more effort to exploit.

someone didnt just figure ut out, it wss dislosed as a 9.8 CVE in 2019 .

Re: WD My Book users wake up to find their data deleted

#378

Post by cjg »

freeone3000 wrote: post #282
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

I agree with your conclusion of increasing the length of support. But your half-life analysis isn't really the right choice. Hard drives tend to have a bath-tub failure rate: https://en.wikipedia.org/wiki/Bathtub_curve

Re: WD My Book users wake up to find their data deleted

#379

Post by alpaca128 »

throwawayboise wrote: post #297
freeone3000 wrote: post #282

Earlier quoted context omitted.

I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.

12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.

...and yet Apple still fixes security bugs in your OS even if your laptop is outside of warranty. I say as long as the device still connects to the internet without a clear error message etc. it should be supported. Realistically the average user has better things to do than check the support period of a random network drive they bought at some sale.

Re: WD My Book users wake up to find their data deleted

#380

Post by terramex »

ksec wrote: post #315
WantonQuantum wrote: post #203

Earlier quoted context omitted.

The iPhone I’m writing this on is several years old and fully patched. I don’t pay a subscription to Apple for the phone.

iOS is only something like 5 years support ( Which is great ). My Book Live goes as far back as 2011. I am pretty sure no security update are being provided to iPhone 4s.

> I am pretty sure no security update are being provided to iPhone 4s.

You are right, but iPhone 5s (released in 2013) got a security update 9 days ago.

Post reply on HN