Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WD My Book users wake up to find their data deleted

arstechnica.com

Post reply on HN
Print view View original

621–630 of 701 posts

Re: WD My Book users wake up to find their data deleted

#621

Post by megous »

OldTimeCoffee wrote: post #544
megous wrote: post #447

Earlier quoted context omitted.

Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Just that attackers didn't choose to destroy a device in this instance, but just erased it, doesn't mean allowing control of all software on the device to randos on the internet, by not patching a root RCE vulnerability is not a physical safety issue.

> Total remote control of the device allows quite a bit... disabling thermal protection, disabling fans, changing voltages on regulators to be out of allowed range, etc. Having total remote control of an IoT device doesn't mean any of these things. Thermal protection is hardware driven typically on die, on cheap devices fan control is implemented in hardware because it's cheaper and easier than software solutions. Vo…

All of that is software controllable on many devices, especially on SoC based NASes. Working range of adjustable regulators is almost always higher than the device connected to it (resistor may be used to set the default voltage for example), on pretty much all HW I've seen so far with no way to set hard limits. And you can also cause issues just by abusing transients even on regulators that can only be turned on/off. Thermal protection on SoCs is usually based on SW regulation loop. (grep for cooling-device through DTSes in Linux tree, all those SoCs have regulation in SW)

Re: WD My Book users wake up to find their data deleted

#622

Post by caymanjim »

ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

> I smell (but have no idea of the merits of) a class action lawsuit.

Class action lawsuits don't seem to help anyone except lawyers. I'm not being cynical; they really seem to benefit only lawyers. I've gotten caught up in plenty of class action payouts over things like this, and invariably I lose more on the time wasted reading the letter or email about it than I gain from being part of the class. Things like checks for $1.90 or a month of "free" service from something I haven't used in years. I want companies to be punished for egregious failures (not sure this one qualifies), but I'd honestly rather have the money go 100% to the government and be used to fund more enforcement and prosecutions. It's adding insult to injury when they make token reimbursements to us peasants.

Re: WD My Book users wake up to find their data deleted

#623

Post by midrus »

neop1x wrote: post #520
midrus wrote: post #293

Is there any modern, reliable replacement for the old "Time Capsule" from Apple? I have a home server with samba, etc where I'm pushing Time Machine backups, but I'd prefer something standalone that doesn't require much setup. What are others using for this?

I have a small "normal pc-like" box with up-to date Linux. It required some initial setup but it will be supported forever and almost any software can be installed there.

Yes, that's my current solution. But I'd rather have something fanless, with internal drives and no need to setup linux and/or samba, etc...

Re: WD My Book users wake up to find their data deleted

#624

Post by addingnumbers »

HotHotLava wrote: post #614
addingnumbers wrote: post #594

Earlier quoted context omitted.

> explain how it could happen to seemingly all MyBook's at once Explain what makes you think this happened to all of them at once. That's a huge leap

There are comments in this thread from people who read about this in the news, checked their own device, and found it was wiped as well. This seems like it would be very unlikely to happen if this were just happening in isolated cases.

Now you're just advocating for the Hasty Generalization Fallacy

Re: WD My Book users wake up to find their data deleted

#625

Post by ric2b »

ineedasername wrote: post #305
ivraatiems wrote: post #199

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support…

From the CVE, the Overall CVSS Score was only 9.8 That means they were still 0.2 away from the worst possible vulnerability score. So, on the one hand, Could be worse! On the other hand, there could be a software dev sitting out there thinking "I screwed up big time & didn't even get a perfect score on it. Oh well, better luck next time."

I guess it's not a 10 because it couldn't cause a fire or explosion?

You can't just expect to get a perfect score by accident, you need to work for it.

Re: WD My Book users wake up to find their data deleted

#626

Post by tlavoie »

sam_lowry_ wrote: post #385
tlavoie wrote: post #314

Earlier quoted context omitted.

I have one, and looked into what I might put on it instead of the unsupported software some years ago. I had noticed shortly after purchase that it was basically a Debian install, on MIPS if I recall correctly. While WD had essentially washed their hands of the device ages previous, it wasn't going to have a current Linux to put on either. Maybe one of the BSDs could be an option. Instead of worrying too much about i…

I had WD MyBook World and WD MyBook Live devices for many years as cheap cold storage. Replaced the last one earlier this year by an Olimex Storage Box [1] and a Seagate 2,5" 4TB ST4000LM016 drive. But even when I operated them, I disabled all the cloud features. These were Debian boxes, you could ssh in, enable NFS, stop all WD proprietary software and live happily every after. Newer WD NAS devices are much harder t…

Even as Debian boxes, they're limited because Debian isn't supporting the platform any more either. That means you can't just point it to a new repo, and do all the usual apt goodness to get an up to date system.

I'm leaning toward one of these as a basic NAS replacement: https://ameridroid.com/collections/single-board-computer/pro... Based on the Odroid XU4, it's a fairly speedy little SBC that runs Armbian, and has a heat sink that doubles as mounting for your hard drive of choice.

Re: WD My Book users wake up to find their data deleted

#627

Post by nacs »

lrem wrote: post #310
fallingknife_ wrote: post #125

Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your co…

After using exclusively WD for some decades I've seen the WD Red fiasco[1] and decided to not use WD any more. [1]: https://blocksandfiles.com/2020/04/14/wd-red-nas-drives-shin...

What are you using now?

Seagate is the other big consumer brand and they also have their own set of issues. Anecdotally, I've had multiple Seagate drives die within a year or 2 whereas WD ones have kept going for years longer.

Re: WD My Book users wake up to find their data deleted

#628

Post by intrasight »

haswell wrote: post #2

Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering c…

I've been using Synology products for about ten years and remain happy.

Re: WD My Book users wake up to find their data deleted

#629

Post by MisterBastahrd »

zeroxp wrote: post #517
bryanrasmussen wrote: post #502

Earlier quoted context omitted.

>remotely raised temperatures on people's thermostats to save power why would raising temperatures save power? probably a silly question but I'm confused.

Raising the temperature during a heat wave is the same as increasing the threshold where the ac unit kicks in. So instead of all these ac units clicking on to cool off houses at any temp above 70 degrees, the ac units click on at 80 degrees. That change saves a ton of energy.

One of the things I do during the year is set the AC according to the outside temperature. During the winter months, my house is set to 70 degrees. As the average outside temperature rises, I increase it by 2 degrees for every 10 from 60. So when it's 100 degrees outside, it's 78 indoors. I have an older unit and watched in horror last year as it struggled and failed to cope with 110 degree temperatures.... I basically just gave up, shut it down, and waited until night time to turn it back on.

Re: WD My Book users wake up to find their data deleted

#630

Post by ChicagoDave »

Looks like I had the "Update My Device" setting off. Whew. I have 20 years of kids photos and videos, though I'm nearly positive I've backed this up and shared it with my ex-wife.

Nearly had a heart attack when I saw this.

Though mine is the WD MyCloud device. I have a MyBook one too, but it's offline. Is the MyCloud device included in the issue?

Post reply on HN