Can't wait for my 3$ as compensation for losing all the data. Seriously now. A class action lawsuit should end with the culprit being out of business in cases of extreme negligence like this one. Anything less just incentivizes them to weight "risk/benefit" of not doing anything
WD My Book users wake up to find their data deleted
211–220 of 701 posts
Re: WD My Book users wake up to find their data deleted
#212Imagine if your cryptocurrency wallet or passwords was on this cloud only system. It is designed to backup your data on the cloud and then it deletes it instead.
Not even their cloud is doing well for its self then. Exactly why I kept on pushing for self-hosted systems; in this case a local NAS.
Re: WD My Book users wake up to find their data deleted
#213According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
From what I can find, this particular device was launched around 2011, and went end of support pre-2016.
(Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things).
And maybe highlights that support lifecycles for IoT devices should be longer.
Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.
Re: WD My Book users wake up to find their data deleted
#214Can't wait for my 3$ as compensation for losing all the data. Seriously now. A class action lawsuit should end with the culprit being out of business in cases of extreme negligence like this one. Anything less just incentivizes them to weight "risk/benefit" of not doing anything
This has never happened before and could seriously ruin the brand.
[EDIT: widespread, very public data loss with a remote cause, as a result of a firmware vulnerability in a product whose job is to store data]
Re: WD My Book users wake up to find their data deleted
#215Earlier quoted context omitted.
You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.
A physical write enable switch? My computer is doing automatic hourly backups, how is that going to work?
A small robotic arm to flip the switch, duh.
Re: WD My Book users wake up to find their data deleted
#216A good reminder always to have a minimum of two completely offline backups for any data you actually care about
Re: WD My Book users wake up to find their data deleted
#217There’s a difference between MyBook and MyBook Live. The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection. The MyBook is a more normal NAS. Bought one of these for my dad few years ago without noticing the difference. Cheap, hobbled and bricked itself more than once. Even without this i…
> The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection.
I found a user manual for a My Book Live model that suggests that it supports SMB, NFS, FTP, and AFP [1].
[1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-... (page 6)
Re: WD My Book users wake up to find their data deleted
#218Earlier quoted context omitted.
I do both: I backup to my Synology NAS, which then in-turn uses Synology's Hyper-Backup (which is very nice, btw) to my Azure storage account - costs me about $15/mo to store a few terabytes with PITR recovery back to when I started doing this in 2018. The thing is... I can't help but worry someone's going to compromise my NAS and DBAN the drives and then extract the Azure storage key and use that to delete all my ba…
What’s your threat model? Is there anyone out there with $$$$ who will stop at nothing to part you, a rando, from your old data? Probably not. Are there sophisticated attackers who will burn a couple 0-days to build a botnet for the sole purpose of randsoming NASes AND attached cloud accounts AND the origin systems, accounting for tons of possible configurations? Still pretty unlikely — this is NotPetya level stuff w…
> However, is there a bug lurking in Hyper-backup that might accidentally wipe stuff from Azure storage, and the bug hits a month before your house gets struck by lightning? Maybe…
Brb calling my psychiatrist for more xanax
Re: WD My Book users wake up to find their data deleted
#219Earlier quoted context omitted.
> Why should anyone ever again trust your company to keep their data safe? Because if you need a hard drive, your options are pretty much Western Digital, Seagate, and Toshiba, and they've all had their own problems.
You forget HGST. They have a longer track record of reliable models than any other manufacturer, even taking the death star into account.
Aren't HGST drives also the most expensive ones?
Re: WD My Book users wake up to find their data deleted
#220According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…
From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.
I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.