Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

441–450 of 701 posts

Re: WD My Book users wake up to find their data deleted

#441

Post by smoe »

roel_v wrote: post #408
oblio wrote: post #312

Earlier quoted context omitted.

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

But consumer electronics are written off on much shorter timeframes than cars. Are we going to require support for electronics for 7 years? I would be in favor of it, but I don't see it happen. Device was EoL in 2015, the vuln is from 2019, breach 2021. Even if we take the vuln date, that's 4 years after EoL. The question then becomes: is it reasonable to say that electronics are expected to have a life half of that…

In my opinion the difference should be whether something is the first generation of a product or an iteration. Basically somehow using the Lindy effect to determine how long it should be supported.

E.g. if I had bought the very first generation of the iPhone it would have been much more out of couriosity, not long time usage expectation. But I think there now has been enough development on it, that I should be able to expect the iPhone I bought in 2020 to last say to 2030 somehow if I want to stick with it.

Re: WD My Book users wake up to find their data deleted

#442

Post by sokoloff »

Spivak wrote: post #254
monsieurbanana wrote: post #230

Earlier quoted context omitted.

It's not? Why?

Yeah, I’m falling on this too. A client with write-only privs to a buckets on multiple cloud storage providers is literally the most durable backup in human existence right now. Like nothing else will get you worldwide DR and 30+ 9’s of durability.

3 (designed for) 10 9’s systems whose failure modes are wholly independent might be 30 9s.

I strongly suspect (as in “for the right price would stake my life on it”) that there are some common failure modes across the major cloud vendors’ offerings.

Your advice is directionally sound (and is what I do for family docs and photos); I just think it has fewer meaningless 9s than you’re imagining.

Re: WD My Book users wake up to find their data deleted

#443

Post by jasonkester »

So I have a Schroedinger's MyBook Live in front of me that I disconnected after reading this. I can probably live with it having been wiped, but what is the current wisdom on how I should proceed?

These devices have no way to read from them via USB (which is why I never liked the thing), so the only way to peek in and see if my stuff is still there would be to plug it into the router and power it on. I presume doing that would get it wiped today.

Should I just leave it in its current superposition of wiped and not wiped until a fix comes out?

Re: WD My Book users wake up to find their data deleted

#444

Post by incrudible »

mnw21cam wrote: post #435
adolph wrote: post #162

Earlier quoted context omitted.

The affected model here, known as My Book Live, uses an ethernet cable to connect to a local network. From there, users can remotely access their files and make configuration changes through Western Digital cloud infrastructure. Western Digital discontinued the My Book Live in 2015. The support forum thread was first reported by Bleeping Computer. The affected product is not a drive but a NAS solution. In terms of be…

A NAS isn't actually distinct from a plain drive in that particular way. A plain SATA hard drive is a cheap computer with some attached hardware, just like a NAS. Literally, there's probably at least one ARM CPU core in there controlling everything and communicating over the link to your main computer. The difference is the protocol that goes over the link. In a NAS, it's SMB/NFS access to files over ethernet/wifi, a…

> The difference is small.

One of these things is talking to the internet on its own accord. The other is not. Small difference, huge implications.

Re: WD My Book users wake up to find their data deleted

#445

Post by danielrpa »

WD needs to patch this, but I always recommend people to also have a cold backup of their data. I make a back up of everything I have every 6 months, rotating my target backup device (an external HDD) through a simple command line script. While not 100% hacker proof, it's a lot safer than relying on internet-connected devices.

Re: WD My Book users wake up to find their data deleted

#446

Post by iSnow »

oblio wrote: post #312
ChuckMcM wrote: post #278

Earlier quoted context omitted.

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

That's not exactly great, tbh. A car can easily run for 10y (mine is due for a replacement at 19yo), so 7y seems ecologically unnecessarily wasteful. I get that it doesn't make sense to offer parts for 20yo cars, but if we want to live in a sustainable future, people need to stop replacing cars after 5y or so.

Re: WD My Book users wake up to find their data deleted

#447

Post by megous »

throwawayboise wrote: post #291
petertodd wrote: post #283

Earlier quoted context omitted.

> There's really no winning with this. There is: don't release devices with security flaws in the first place. The fact is, they released a fatally flawed device. That the flaw was discovered later doesn't change that fact. I think the way we talk about security patches and updates obscures the fact that they're correcting fundamentally flawed software. In other circumstances, this would result in product recalls. Th…

Product recalls are for defects that can cause physical injury. If the MyBook had an electrical defect that could cause a shock hazard or start a fire, it would have been recalled. Many products have flaws, but if the worst that can happen is that the customer feels ripped off, they don't get recalled. There might be remedies under a express or implied warranty, but tech products typically disclaim all of that in the…

Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc.

Just that attackers didn't choose to destroy a device in this instance, but just erased it, doesn't mean allowing control of all software on the device to randos on the internet, by not patching a root RCE vulnerability is not a physical safety issue.

Re: WD My Book users wake up to find their data deleted

#448

Post by oblio »

iSnow wrote: post #446
oblio wrote: post #312

Earlier quoted context omitted.

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

That's not exactly great, tbh. A car can easily run for 10y (mine is due for a replacement at 19yo), so 7y seems ecologically unnecessarily wasteful. I get that it doesn't make sense to offer parts for 20yo cars, but if we want to live in a sustainable future, people need to stop replacing cars after 5y or so.

My point wasn't clear. 7 years is quite a long time. And as far as I know in general they can't prevent after market parts being produced.

So car manufacturers are forced to allow their cars to be repaired, not necessarily with their parts, a long time after they've stopped selling them.

IT stuff should start following the same lifecycle.

Re: WD My Book users wake up to find their data deleted

#449

Post by mathieubordere »

jasonkester wrote: post #443

So I have a Schroedinger's MyBook Live in front of me that I disconnected after reading this. I can probably live with it having been wiped, but what is the current wisdom on how I should proceed? These devices have no way to read from them via USB (which is why I never liked the thing), so the only way to peek in and see if my stuff is still there would be to plug it into the router and power it on. I presume doing…

(With the risk of stating the obvious) Can't you access it over the local network if you plug out the internet connection of your router?

Re: WD My Book users wake up to find their data deleted

#450

Post by vanderZwan »

JamesBrooks wrote: post #258

Was very worried when I checked through the 5x 3TB My Books I have to find that all the data was ok - which I thought was odd as they're very old models. Turns out at the start of COVID I re-did my home networking and the gateway addresses on all the My Books were incorrect, so they haven't had internet connectivity for over a year... (quickly adds extra firewall rules to prevent them for bonus safety).

Do you have "My Book" or "My Book Live"? I also have a bunch of external hard drives, but I think they're older than the whole Live bit.
Post reply on HN