Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

691–700 of 701 posts

Re: WD My Book users wake up to find their data deleted

#691

Earlier quoted context omitted.

My backup drive has a physical switch. I used to be meticulous in setting it to read-only except while making a backup. But now I just leave it in read/write mode because I lost my enthusiasm. It's not plugged in when not in use though, so it's a bit safer from this sort of thing. How would you do automated backups with a physical switch? Are you proposing nobody does automated daily or more frequent backups?

I suggest rolling backups. Tapes are also a possibility, as they can be written in append-only mode. Just remember that ransomware will encrypt any drive you hook up to it, including your backup drives. A physical write-enable will prevent that, and it should be disabled anytime you are restoring from backup. I want a write-enable switch even for simple tasks like copying one drive to another, just so I don't mistake…

> and it should be disabled anytime you are restoring from backup.

What I was alluding to but didn't make clear was that physical switches are easily defeated by human laziness or mistakes. Why have a physical switch on drives you're copying if you might accidentally switch the wrong one or eventually stop bothering? This already happens with warning popups in Windows when you try to run an untrusted program, for instance. People get trained to bypass the security because it's just a tedious obstacle.

You personally might be careful enough to forever set the switch correctly, but people who didn't even know their hard drive was years-un-patched and internet connected yet left it there to get hacked also wouldn't reliably set the switches every time either.

Regarding accidentally copying in the wrong direction, I think a safer way than a physical switch is to show some details of what will get deleted. Maybe previews of images, tiny snippets of text from the files, a graphical view of the space they occupy, etc. Make it more visceral, like throwing away an actual book where you can see how many pages it has and what the picture on the cover is.

Re: WD My Book users wake up to find their data deleted

#692
post #551

Earlier quoted context omitted.

The powerpc SoC in that drive is even supported in mainline Linux. And the code for original v2.6.32 Linux and some ancient U-Boot is available on WD website. So people could have made their drives secure after EOL. Some maybe even did.

> So people could have made their drives secure after EOL. A very, very, very select few with the necessary skills could have. This is a mass-market device, if 1 in 10 000 buyers is able to do this, that'd be a lot, and then those would have a Linux machine on an ancient SoC with none of the original functionality.

So? The code is available, which is what the parent commenter wanted. Getting something FOSS running using something that's already supported in mainline Linux is a week long project, perhaps, if you suffer with outdated U-Boot. You can still download the code for this device even on WD's website. (That's quite something, because typically companies start violating the GPL shortly after the device stops being sold, or when they get acquired and redesign their website)

This one would probably be harder, because there's not a ton of 32bit ppc distros around, and the storage is limited, so you'd have to setup some toolchain and build some ppc basis for the userspace, yourself.

I don't think many people would root for some 11 year old WD's trashy userspace code, and would rather want to run current musl, busybox and samba on this, or whatever.

Someone who likes these devices could have done the work and could have published it for others.

Re: WD My Book users wake up to find their data deleted

#693
post #508

Earlier quoted context omitted.

If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This whole, "ah sorry we decided to end-of-life that because we couldn't make any more money off it" is so many levels of bullshit. It's also part of a broader attitude on not repairing anything. Battery dead in your activity tracker? throw it out and buy a new one. Worse still, the band has degraded b…

> If you sell me a HD/IoT, and say it does X/Y/Z and then no longer want to provide X/Y/Z, I should get my money back. This is my takeaway from the whole Peloton fiasco. If you spend thousands of dollars on a product, and after the purchase the company bricks the product, the company should legally owe you a full refund.

I had a perfectly functioning Phillips Hue lighting system, then one day Phillips decided it was no longer supported and I had to buy an upgraded system to get the same features that I already had.

Re: WD My Book users wake up to find their data deleted

#694

Earlier quoted context omitted.

I would agree if't s a non-EoL products. This, not so much. A company should not be permitted to just declare something “EoL” if it is still in widespread usage. They made it, they support it as long as any customer still has it.

> They made it, they support it as long as any customer still has it. I am sure there are Windows NT machines still in service. I think my Dad has one in his basement. Should Windows forever support NT?

I am sure there are Windows NT machines still in service. I think my Dad has one in his basement. Should Windows forever support NT?

If they were offering an online service, then yes. These devices were compromised by WD’s online file sharing tool.

Re: WD My Book users wake up to find their data deleted

#695

Earlier quoted context omitted.

They are not perfect and not always as responsive as I’d like. They issue security updates for their current OS and 2 versions before, AFAIK.

Is this your experience with Apple as a user or as a security researcher?

As a user interesting in security and following the field quite closely. I know about the limitations of their bug bounty program and some bad experiences some people have had with it. They still ship security updates to 8 years old devices and 3 years old OSes. Is that a problem?

Re: WD My Book users wake up to find their data deleted

#696

Earlier quoted context omitted.

I am trying to get rid of any smart devices in my life. I need less things connected to the internet not more. I bought Bruce Shneier's "Click Here to Kill Everybody, and that just convinced me even more. Software is a weak point, and I'd rather have the least amount possible in my "mission critical" everyday life gadgets. I want single-purpose, purpose built devices that do that one thing very well, without connecti…

I never jumped on the “everything IoT” bandwagon, but recently I’ve relented a bit. I own/use exactly 4 “IoT technologies”. I have smart radiator thermostats that turn on/off the heat based on family presence, as well as “predict” the heating needs based on weather forecast, sunshine hours, etc. I have a heat pump in my vacation house that is remote controlled by the internet. Not strictly needed, but very convenient…

What do you use for IDS/IPS? I'm interested in doing something similar.

Re: WD My Book users wake up to find their data deleted

#697

Earlier quoted context omitted.

I never jumped on the “everything IoT” bandwagon, but recently I’ve relented a bit. I own/use exactly 4 “IoT technologies”. I have smart radiator thermostats that turn on/off the heat based on family presence, as well as “predict” the heating needs based on weather forecast, sunshine hours, etc. I have a heat pump in my vacation house that is remote controlled by the internet. Not strictly needed, but very convenient…

What do you use for IDS/IPS? I'm interested in doing something similar.

I used to run on PfSense with Suricata, but my SG-3100 would frequently get rebooted by the watchdog because the load was too high.

These days i just use a Ubiquiti Dream Machine Pro. The base version works just fine as well, the pro just fit better on the shelf, and i didn't need an additional AP.

Re: WD My Book users wake up to find their data deleted

#698

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

I know people that had these and later just opened them up and pulled the drives for use in a freenas box.

So it isn't completely trash, the drives were still usable even though they were done using it as a MyBookLive device.

Re: WD My Book users wake up to find their data deleted

#699
This all goes back to the fact that cloud based / cloud connected storage, that is not also backed up on disconnected media, is essentially insecure/unreliable.

I have cloud accessible storage that is backed up on two separate 2TB USB drives, in A/B fashion. For me, 2TB is enough to cover my irreplaceable data (mostly digital photos).

Re: WD My Book users wake up to find their data deleted

#700

Earlier quoted context omitted.

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it'…

This is an interesting point: there is an analogy to be made with unmaintained equipment that can become environmental hazards and making such equipment without proper warnings and recalls. I was thinking of getting one for myself, but I think I'll stick to USB-connected JBODs.

I live the hybrid life, connected media, with the essential data backed up to disconnected USB drives.

Convenience and resilience at the same time.

Also, you need at least two different USB drives, that you back up to in A/B fashion. I prefer to own two separate brands.

Post reply on HN