Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

311–320 of 701 posts

Re: WD My Book users wake up to find their data deleted

#311

Post by tonfreed »

IncRnd wrote: post #236
WalterBright wrote: post #160

Earlier quoted context omitted.

You should trust anything connected to the internet. Demand a physical write-enable switch from your backup drive vendor.

In this particular case, there were My Book drives and My Book Live. When the Live part was configured, you would be creating an entry-point into your network for WD to run code on your drive. I know this, because I purchased one, and read the small getting started guide that came with it. Needless to say, I never ran any of the Live code. Several of these sorts of things have come up in the industry that always made…

See, I would care less about all this phoning home if I got the option to opt out like that.

Re: WD My Book users wake up to find their data deleted

#312

Post by oblio »

ChuckMcM wrote: post #278
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to af…

When a car manufacturer sells a car, in many parts of the world they're supposed to still offer parts for it for 7 years after they stop selling it, by law.

Re: WD My Book users wake up to find their data deleted

#313

Post by throwawayboise »

SOMA_BOFH wrote: post #265
xyzzy123 wrote: post #214

Earlier quoted context omitted.

This has never happened before and could seriously ruin the brand. [EDIT: widespread, very public data loss with a remote cause, as a result of a firmware vulnerability in a product whose job is to store data]

this will be forgotten in six months.

Most people will never hear about it.

Re: WD My Book users wake up to find their data deleted

#314

Post by tlavoie »

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

I have one, and looked into what I might put on it instead of the unsupported software some years ago.

I had noticed shortly after purchase that it was basically a Debian install, on MIPS if I recall correctly. While WD had essentially washed their hands of the device ages previous, it wasn't going to have a current Linux to put on either. Maybe one of the BSDs could be an option.

Instead of worrying too much about it, I have the remote access feature turned off, and have other backup options in case this goes belly up. I will be looking closely at what vulns come to light as being exploited though.

Re: WD My Book users wake up to find their data deleted

#315

Post by ksec »

WantonQuantum wrote: post #203
MattGaiser wrote: post #184

Earlier quoted context omitted.

That just effectively means a subscription. So your hard drive will be $100 + $10 a month.

The iPhone I’m writing this on is several years old and fully patched. I don’t pay a subscription to Apple for the phone.

iOS is only something like 5 years support ( Which is great ). My Book Live goes as far back as 2011.

I am pretty sure no security update are being provided to iPhone 4s.

Re: WD My Book users wake up to find their data deleted

#316

Post by pcnix »

dunham wrote: post #164
_carbyau_ wrote: post #96

Earlier quoted context omitted.

I haven't yet implemented it but perhaps a reciprocal syncthing arrangement with an IT knowledgeable friend?

I didn't think syncthing supported encrypted replicas - that's why I passed on it years ago for a dropbox-like use case. I wanted to have a replica in the cloud as a relay, without having to fully trust the machine. A quick google suggests they may have something beta along these lines, so this may change. I believe Resilio can do it, but it is closed source. If you're looking for backups and not dropbox-like functio…

Syncthing now supports untrusted encrypted nodes, and it's fairly reliable.

Re: WD My Book users wake up to find their data deleted

#317

Post by slim »

msravi wrote: post #307
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?

Either it's advertised through mdns or you add "panel" to your hosts file with the right ip

Re: WD My Book users wake up to find their data deleted

#318

Post by Legion »

boardwaalk wrote: post #292
bigiain wrote: post #123

"The My Book Live device received its final firmware update in 2015." A unpatched in 6 years linux device directly connected to the internet? What could possibly go wrong? "There is no IoT, there is only the internet of unpatched linux boxes."

This doesn't appear to have anything directly to do with Linux, just crappy software written by WD running on it. Please be a little more careful with your criticism.

I don’t think the commenter was criticizing Linux. Seemed more a comment on the manufacturers who lazily slap these products together with minimal effort. Taking a free OS, sprinkling a thin layer of their software on top, and then abandoning their responsibility to maintain the full software stack being a common example of that minimal effort.

So, yes, essentially you end up with a bunch of devices running vendor-specific unmaintained Linux distros on the wide open Internet. The “unmaintained” part of that sentence is the problem, not the “Linux” part.

Re: WD My Book users wake up to find their data deleted

#319

Post by throwawayboise »

loktarogar wrote: post #309
throwawayboise wrote: post #297

Earlier quoted context omitted.

12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.

They would. But if there was a software vulnerability that would wipe out the hard drives of computers still realistically in use, much past that 3 year agreement expiry? i'd expect them to be on that.

Suppose there were a vulnerability in Mac OS X Tiger that wiped the hard drive of any G4 Powerbook connected to the internet. Would you expect Apple to be on that?

Re: WD My Book users wake up to find their data deleted

#320

Post by bigiain »

xvector wrote: post #238
bigiain wrote: post #130

Earlier quoted context omitted.

Backblaze's latest drive report shows an annual failure rate for hard drives of 0.85%. I very strongly suspect the total of all failures of the type you're listing there is many orders of magnitude lower than that across all cloud storage users. If you care about your backups, a single cloud vendor/account vanishing isn't going to be a problem, in exactly the same way that if you care about your backups,m a single dr…

> in exactly the same way that if you care about your backups, a single drive failure will not be a problem 0.85% is extremely high. I've rolled enough 1s on d100s to know that I wouldn't take those odds!

Yeah, but it certainly feels in the right ballpark from my personal experience. I’ve normally got 20 or so drives in use at any time (perhaps fewer spinning rust drives not that ssds are more common), and I have a drive go bad occasionally - not every year or two, but certainly every 5 years. So I reckon they’re at least order of magnitude right.
Post reply on HN