WD My Book users wake up to find their data deleted • Hacker News Board

Re: WD My Book users wake up to find their data deleted

#601

Post by criddell » Fri, Jun 25, 2021, 2:12 PM UTC

cfn wrote: post #404

ksec wrote: post #296

Earlier quoted context omitted.

And of course Qnap in the recent month. It keeps repeating, and keeps happening, and some ( me ) keep ranting about it and no one / company is doing anything much with it. Majority of people buy NAS only use it to access their Data within their internal network. But somehow they all include Internet / Cloud features as upsell.

Can you give a link to what is happening with QNAP? I have one and now I am worried.

They had hard coded credentials in a service that lots of people inadvertently exposed to the internet.

https://www.bleepingcomputer.com/news/security/qnap-removes-...

Re: WD My Book users wake up to find their data deleted

#602

Post by FridayoLeary » Fri, Jun 25, 2021, 2:12 PM UTC

andylynch wrote: post #407

Algent wrote: post #371

Earlier quoted context omitted.

With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.

I think that's more a specific vendor / android thing? I just bought a 2016 iPhone SE second hand. It's running the latest iOS 14 right now, and is officially supported on iOS 15 too.

I think Apple is an outlier in terms of support, which i think is silly, because 5 years of support really should be taken for granted. There are many working phones or computers that are 10 or 15 years old and healthy.

Re: WD My Book users wake up to find their data deleted

#603

Post by black_puppydog » Fri, Jun 25, 2021, 2:31 PM UTC

gertrunde wrote: post #213

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.

That's three years for a device that is presented as an archival thing that you put in our broom cupboard and forget about. That is insanely short.

Re: WD My Book users wake up to find their data deleted

#604

Post by harikb » Fri, Jun 25, 2021, 2:33 PM UTC

kingsuper20 wrote: post #550

harikb wrote: post #504

Earlier quoted context omitted.

I was counting that as an example of a tech done well! CA does this too, but afaik, it is advertised as such when one signs up for a free Smart meter and there is even a slightly better rate offered. I just don’t see an alternate way to implement this. Prompting users via pricing is not something that will quick enough or intuitive enough. Also the sacrifice they are asked to make is at most a few degrees

>I just don’t see an alternate way to implement this. Increase capacity. By running the system ever closer to the bone you simply cause more disasters.

We are all underestimating the level of fluctuation in energy requirement caused by a slight weather change. If the system were to have capacity comparable to max possible usage, the rates would be sky high. This is not like storing water and even that we can’t store beyond a certain point. See what happens with flood and drought patterns. The power company will sell it to someone cheap, we just don’t store it

https://www.upi.com/Archives/1983/03/14/The-last-episode-of-...

Re: WD My Book users wake up to find their data deleted

#605

Post by oldgradstudent » Fri, Jun 25, 2021, 2:34 PM UTC

dikei wrote: post #201

shash wrote: post #183

There’s a difference between MyBook and MyBook Live. The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection. The MyBook is a more normal NAS. Bought one of these for my dad few years ago without noticing the difference. Cheap, hobbled and bricked itself more than once. Even without this i…

I think you are confused between My Book and My Cloud * My Book: An external HDD that's attached to your computer through USB. * My Cloud: A NAS that's connected to your network through Ethernet, support SMB, FTP, NFS. There's also My Cloud Home, which is also a NAS, but you can only access your data through WD proprietary app, not SMB.

My Book Live: Older version of My Cloud.

Re: WD My Book users wake up to find their data deleted

#606

Post by pomian » Fri, Jun 25, 2021, 2:43 PM UTC

haswell wrote: post #70

shric wrote: post #13

Earlier quoted context omitted.

I've never tried FreeNAS, but am surprised it took so much maintenance. I've been using FreeBSD with an HP Microserver and ZFS for the same purpose for about 10 years. I just install the updates and everything just works. Curious what kind of maintenance is taking up your time?

For me, the issues were mostly related to the period of time I started using FreeNAS, and getting a bit too creative with plugins and jails. On the first part, there was a period of time when the project was going through some upheaval (quite a few years ago now) and I had some issues with upgrades. This goes hand in hand with the 2nd thing - I was trying all sorts of plugins and using it as a BT and newsgroup client…

Those projects that start easy, and then suffer from: hmm, let's try that, then let's try these add ons, etc. And everything works, for years, and then you need to return to them, but can't remember anything! And then, it turns out, that you don't have the time you used to have. And even though you loved tinkering late into the night, 10 years later, hight has become precious. For sleeping. Or trying to sleep!

Re: WD My Book users wake up to find their data deleted

#607

Post by Spivak » Fri, Jun 25, 2021, 2:46 PM UTC

emodendroket wrote: post #528

Spivak wrote: post #246

Earlier quoted context omitted.

I find it funny that we simultaneously work in places that understand that software requires constant maintenance and charge customers a recurring fee for it while being gobsmacked that we have to pay indefinitely for the same. You go on-prem for the same reason you work does. Because the software licensing plus the amortized cost of hardware is less than the subscription.

Been a while since I’ve worked somewhere that actually did on-prem data storage.

I'm surprised since data storage, transfer, and compute are the things that you can absolutely beat every cloud provider on in terms of price. It was why we keep our storage in our own DC.

Re: WD My Book users wake up to find their data deleted

#608

Post by riobard » Fri, Jun 25, 2021, 2:47 PM UTC

The WD My Book Live series NAS has two models, a single-disk one called just My Book Live where the disk is not user-replaceable, and a dual-disk one called My Book Live Duo where the two disks can be replaced tool-free. AnandTech had a pretty thorough review of the single-disk one https://www.anandtech.com/show/4952/wd-my-book-live-network-....

I had the MBL Duo. It ran on an 800MHz Applied Micro APM821XX PowerPC processor with 256MB RAM. The stock firmware was a customized version of Debian. I couldn't remember exactly which version of Debian but it's definitely older than Debian 9. Maybe 6 or 7? Anyway, you can enable SSH access via web UI and directly login to the device and see everything running there.

IIRC WD used OpenVPN to establish a connection to their servers to allow remote access to these devices behind NAT and firewalls. I had always been wondering what if their servers were hacked and then hackers could theoretically access the NAS via that VPN connection and by extension my LAN behind firewalls so I disabled the remote access feature.

A couple of years back I finally got tired of the ancient Debian, and since WD had already deprecated the device without further updates/patches, I was looking for alternatives. There were people on WD forums trying to compile and install newer versions of Debian. But since the device does not have video out or console port, it was very easy to mess up and got bricked.

Eventually I found OpenWRT (yes, the linux-based router OS) had official support for both MBL models (https://openwrt.org/toh/western_digital/mybooklive) and the installation seems pretty safe (especially for the Duo with replaceable disks). So I went with OpenWRT and never looked back.

My MBL Duo now sits at my parents-in-law's place running OpenWRT. I had setup WireGuard to connect it to my LAN in another city and used it as a remote backup destination in case of either place catching fire or whatever other disasters.

And now I feel pretty lucky for my decision to ditch the original firmware. Good riddance!

Re: WD My Book users wake up to find their data deleted

#609

Post by nitrogen » Fri, Jun 25, 2021, 2:56 PM UTC

bcrosby95 wrote: post #600

wycy wrote: post #591

Earlier quoted context omitted.

How could an oven or washing machine possibly be useful remotely?! I'm a fan of connectivity, but that just seems absurd for those appliances.

Being able to remotely preheat my oven could be useful. But not enough to justify the risk of someone else remotely preheating my oven.

It could also be useful for anyone who worries they left the oven on.

Re: WD My Book users wake up to find their data deleted

#610

Post by dubya » Fri, Jun 25, 2021, 3:00 PM UTC

fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

Mine is still prompting me to register my device. It's been a secondary Time Machine backup for 10+(?) years, but really is too slow to ever do a restore from. This is a good reminder to replace it.