WD My Book users wake up to find their data deleted

Post by ineedasername » Fri, Jun 25, 2021, 3:21 AM UTC

mr_toad wrote: post #97

ineedasername wrote: post #65

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors". I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't ex…

> Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? I doubt it. The specs list UPnP support. DLNA on some versions too. No consumer device is going to expect the average punter to mess with NAT.

Post by shash » Fri, Jun 25, 2021, 3:23 AM UTC

Post by emodendroket » Fri, Jun 25, 2021, 3:26 AM UTC

MattGaiser wrote: post #184

zmmmmm wrote: post #175

Hopefully this flushes out the elephant in the room of the irresponsibility of manufacturers selling devices like this and then leaving the software unpatched / unupdated within a year or two of selling it. Unfortunately this needs to become regulated. Either commit to "lifetime" updates (at least 10 years) or be forced to put a massive warning on the label advising the secure period for which the product can be used…

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

Post by MattGaiser » Fri, Jun 25, 2021, 3:27 AM UTC

emodendroket wrote: post #185

MattGaiser wrote: post #184

Earlier quoted context omitted.

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

If I'm going to pay a subscription fee, why am I even bothering with an on-premise solution really.

Post by bigiain » Fri, Jun 25, 2021, 3:28 AM UTC

haswell wrote: post #158

martyvis wrote: post #138

Earlier quoted context omitted.

By definition "directly connected to the internet" means if a device can on its on accord, direct requests to an entity, ask it a question, and act upon it is true. From what I understand these WD boxes go to a management service in the cloud. and were told they should factory reset. Whether something is pull-only (as in this case) or push (say allows HTTP or SSH access from a random on the internet) is irrelavnt if…

In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall. For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”