29 ms·

WD My Book users wake up to find their data deleted

• mensetmanusman 5y ago
  I offload my memories onto hard drives. When these are destroyed, it feels like a part of me is gone.
• haswell 5y ago
  Very interested to see what the root cause ends up being - this is mind bogglingly bad. I know several people who use these devices because of their simplicity, and they’d be devastated. I run a FreeNAS setup at home on an HP MicroServer. From time to time, I lament the amount of time I’ve spent over the years maintaining it, and after a recent drive failure (and wishing for more performance), I started considering consumer options like Synology/QNAP. Articles like this always give me pause, and remind me why I invest the time I do to maintain my own thing. I’d rather fuck something up myself than fall victim to an issue like this, and the time spent setting it up likely pales in comparison to dealing with data recovery. I really hope these users can get their data back.
  • TheGuyWhoCodes 5y ago
    Qnap had a lot of security issues in the past, like unpatched RCE and backdoors. I wouldn't recommend, (and never ever use qnap cloud or upnp) as it seems they don't really do a good job on software QA or penetration testing or security audits. Hardware is fine but it's much more expensive than just building it yourself.
    • lazide 5y ago
      QNAp takes the ‘just ship it’ approach. They have a lot of functionality, but it’s clear if you deal with their software much that it was a rush job. Lots of random breakages, bugs, stability issues, etc. You’re wise to not trust it with anything important.
    • Marsymars 5y ago
      Some of their hardware is tough to do yourself. e.g. I've got a TL-D800S hooked up to my home server. I know I could build something comparable, but once hardware involves actual "building" rather than just "assembly", it's past the level of effort I want to spend.
  • shric 5y ago
    I've never tried FreeNAS, but am surprised it took so much maintenance. I've been using FreeBSD with an HP Microserver and ZFS for the same purpose for about 10 years. I just install the updates and everything just works. Curious what kind of maintenance is taking up your time?
    • teejmya 5y ago
      I was going to ask the same thing, as someone who's run FreeNAS on the AMD-based HP Microserver for nearly 8 years now. The only fiddly bit to setup for me was LetsEncrypt auto-renewals, but once I had it automated I never needed to touch it again.
    • haswell 5y ago
      For me, the issues were mostly related to the period of time I started using FreeNAS, and getting a bit too creative with plugins and jails. On the first part, there was a period of time when the project was going through some upheaval (quite a few years ago now) and I had some issues with upgrades. This goes hand in hand with the 2nd thing - I was trying all sorts of plugins and using it as a BT and newsgroup client. These did not upgrade well. I suspect that a fresh vanilla build (TrueNAS now) would probable be zero maintenance. I need to upgrade my drives (a bunch of 1TB drives from the era I built it), and I’ll probably use this opportunity to start fresh.
      • pomian 5y ago
        Those projects that start easy, and then suffer from: hmm, let's try that, then let's try these add ons, etc. And everything works, for years, and then you need to return to them, but can't remember anything! And then, it turns out, that you don't have the time you used to have. And even though you loved tinkering late into the night, 10 years later, hight has become precious. For sleeping. Or trying to sleep!
  • xattt 5y ago
    I converted a QNAP device to Ubuntu after the updates stopped coming. It’s decent and fits perfectly where it lives in my house. Of all things, it has a weird boot-up bug where it fails to boot to Ubuntu during about a half-hour period (around :15 and :45) each hour and lands on a kernel panic within a second after grub. I have no idea where to start. Firmware is latest.
    • bombcar 5y ago
      Interesting - is it reliably between those times? What is the panic?
      • xattt 5y ago
        I’m about 3/4 certain that it’s between those times, and never at the top of the hour. Getting the exact panic would unfortunately mean to have to get it down from the shelf where it lives, and plugging it into a monitor to replicate. It doesn’t make it out of low-res text mode when it does. Most of the time, I’m usually in a rush to get it back up as my family wants lights and Plex to work normally. I do my best not to reboot to keep the peace!
        • cmeacham98 5y ago
          If you get a chance to test, I'd recommend changing the time on the device and seeing if that makes a difference, should clue you in on if it's a software or environment issue.
  • flatiron 5y ago
    My guess is someone figured out how to bounce commands off WD command server (customer reps helping people reset their devices) and they are spamming customer ids. Either that or these devices have unique ports on the WAN with a 0-day but that would take a lot more effort to exploit.
    • dannyw 5y ago
      someone didnt just figure ut out, it wss dislosed as a 9.8 CVE in 2019 .
      • HotHotLava 5y ago
        That CVE only shows how to factory-reset a single MyBook to which you can connect and send HTTP requests. There's still something missing to explain how it could happen to seemingly all MyBook's at once, including those behind a NAT.
        • addingnumbers 5y ago
          > explain how it could happen to seemingly all MyBook's at once Explain what makes you think this happened to all of them at once. That's a huge leap
          • HotHotLava 5y ago
            There are comments in this thread from people who read about this in the news, checked their own device, and found it was wiped as well. This seems like it would be very unlikely to happen if this were just happening in isolated cases.
            • addingnumbers 5y ago
              Now you're just advocating for the Hasty Generalization Fallacy
  • gruez 5y ago
    >Very interested to see what the root cause ends up being The article says: >Multiple users reported that the data loss coincided with a factory reset that was performed on their devices. One person posted a log that showed unexplained behavior occurring on Wednesday: I'm leaning more towards 0day than "software bug", mainly because I can't really think of a reason why a bug would cause the factory reset to get triggered, but I can think of plenty of ways an internet connected NAS can be exploited.
    • JKCalhoun 5y ago
      > internet connected NAS I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.
      • klodolph 5y ago
        For certain notions of "read/write", the risk can be lower. You might make backups to storage, but not have permission to delete files. Or when you delete files, they are kept for a certain safety window (e.g. if you delete a file on June 24, the file is instead moved and can be restored any time before July 24, at which point it is purged).
      • gruez 5y ago
        >I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane. It's a NAS. Backup isn't the only thing you can do with it. A personal cloud (aka dropbox) is also a valid use case, and requires internet access to work.
  • djrogers 5y ago
    > I know several people who use these devices because of their simplicity, and they’d be devastated. I can’t imagine a scenario where I’d rely on an 8-10 year old device that hadn’t received a security update in 6+ years…
    • userbinator 5y ago
      There are countless systems out there which are far older and also more secure. Age is of zero relevance except to those who propagate forced obolescence, mindless consumption, and generation of massive amounts of e-waste. This "update mentality" is a cancer itself. Especially when this is supposed to be a simple device. That said, relying on the same credentials for a long time is more problematic. My bet is on credentials being bruteforced, especially if many people have left them at their default or used easily guessable ones.
      • davidcbc 5y ago
        Age is of zero relevance for hard drives?
        • bigiain 5y ago
          Also - age is of zero relevance to internet connected linux devices? I rely on many "8-10 year old device that hadn’t received a security update in 6+ years". My coffee machine. My fridge. My hifi. All my motorcycles. None of them run linux and are directly connected to the internet.
          • haswell 5y ago
            But think about this from the perspective of the average buyer/user. Hard drives are traditionally "local". Local = safe. Now, a new generation of drives are introduced with this awesome capability to get access to data remotely. "Cool", they think. They don't understand how the Internet works, and so they don't really see the issue, or if they have a basic understanding of networks they might understandably believe that "it's behind the router, so it's safe".
  • technion 5y ago
    QNAP's recent situation was hard to believe. Having only just fixed a significant SQL injection vulnerability[0], a spate of ransomware hit. It was originally announced to be this issue that people rushed out to patch[1]. It ultimately turned out to be a backdoor account[2]. Backdoors really upset me. Every reasonable "you can't blame people for mistakes" goes out the window when it's not a mistake. Following the ransomware, they released an auto-installing malware remover. A Python script that detected one particular piece of code associated with this recent attacker. That malware remover was a python script full of vulnerable exec calls introducing multiple new RCEs. [0] https://www.qnap.com/en/security-advisory/qsa-21-11 https://www.qnap.com/en/security-advisory/qsa-21-11 [1] https://www.qnap.com/de-de/security-advisory/qsa-21-05 https://www.qnap.com/de-de/security-advisory/qsa-21-05 [2] https://www.bleepingcomputer.com/news/security/qnap-confirms-qlocker-ransomware-used-hbs-backdoor-account/ https://www.bleepingcomputer.com/news/security/qnap-confirms... [3] https://www.qnap.com/en/security-advisory/qsa-21-16 https://www.qnap.com/en/security-advisory/qsa-21-16
    • nneonneo 5y ago
      Wow. Back door accounts are just totally inexcusable these days - manufacturers should be held to account if their back doors end up getting exploited by threat actors. (Granted, you could argue it’s hard to distinguish between a really terrible bug and a back door, sometimes, but “intent” should cover this difference…) Would you happen to have a write up/article about this series of events that isn’t a sanitized series of security bulletins? Sounds like it’d make for good reading.
      • technion 5y ago
        Try this: https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450#p788325 https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=450...
        • rawoke083600 5y ago
          Wow !
        • 5y ago
  • lrem 5y ago
    Have you ever found a fix to FreeNAS not knowing how to slow down the fan in the Microserver? Or is your generation free of this issue?
  • intrasight 5y ago
    I've been using Synology products for about ten years and remain happy.
• romwell 5y ago
  There are two kinds of users: those who back up their data, and those who haven't experienced a data loss yet. This is your daily reminder that anything that's connected is not a backup. Yes, that includes the hard drive in your machine. For that matter, RAID is not a backup solution. Yes, that includes cloud sync (Dropbox/OneDrive/GDrive/etc) that propagates changes automatically. That's not backup. And that includes WD My Book, as it (unsurprisingly) turns out. Take this as a PSA. If you want to be more enlightened: http://www.taobackup.com/ http://www.taobackup.com/
  • SAI_Peregrinus 5y ago
    A Copy-On-Write Append-Only system CAN be a backup, even if connected. But that takes a lot more storage space, so it's more expensive.
    • romwell 5y ago
      I wouldn't call it a backup without further clarifications. Like, if it can be killed by the same power surge that takes your main server out, I wouldn't call it a backup. There are a lot of ways to introduce redundancy in the system that would make backups needed much less frequently (if ever). But what a backup does is it allows you to have your data in case your system and accounts are compromised, whether through a misuse, failure, or an attack vector.
      • SAI_Peregrinus 5y ago
        ANY backup solution can go down with a big enough disaster. An on-site backup is A backup, but it shouldn't be the ONLY backup. Typically you want a hierarchy of backups, one of which is on-site and on-line but a different machine, another of which is off-site but on-line, and possibly one or more offline backups. But on-line backups are fine, IF (and only if) they're copy-on-write/append-only. Of course if the data can be deleted or overwritten too soon (even tape drive backup systems have some period over which they start re-using tapes) it's worthless. But that's an entirely separate concern from whether it's always-on or internet-connected or on the same national power grid segment as the original.
• robotnikman 5y ago
  Sounds like its affecting people using the My Book live service to access it over the internet Just wow though... Hopefully its not actually doing something like overwriting the data with random bits and just deleting the pointers to the file in the MFT. If the latter case, the data can be easily recovered
  • grrowl 5y ago
    I would hope (but I do not expect) Western Digital to recover the data for the end users. This is a really bad situation for some.
    • munk-a 5y ago
      The article mentions that a factory reset was performed on the devices. Factory resets usually leave the data in a readable state depending on how paranoid the developers coding them are - you're not usually going to run shred -n 11
      • crazysim 5y ago
        I don't know whether to hope the factory reset resets by keys erasure or not. If it doesn't, the affected users stand a chance for recovery.
• function_seven 5y ago
  It may sound a little unfair, but the MyBook has been on my personal Ban List for 14 years now. (has it been that long?) I don't know if they still do this, but there was a time their NAS would refuse to allow access to MP3 files over a network. To fight piracy. https://www.theregister.com/2007/12/07/western_digital_drm_crippled_harddrive/ https://www.theregister.com/2007/12/07/western_digital_drm_c... (Was www.wired.com/2007/12/western-digital)
  • tyingq 5y ago
    Ironically, story is posted on a paywall site :)
    • function_seven 5y ago
      That is ironic. I visit Wired so rarely now I guess I got my one free article. Better link? https://www.theregister.com/2007/12/07/western_digital_drm_crippled_harddrive/ https://www.theregister.com/2007/12/07/western_digital_drm_c...
      • anonymousisme 5y ago
        Works fine with JS turned off (via NoScript).
    • thaumasiotes 5y ago
      I don't see anything. The site isn't DRMed either; I'll demonstrate by pasting the text of the article: > It doesn't matter what the files are: If you try to share these formats over a network, Western Digital assumes not just that you're a criminal, but that it is its job to police users. You see, MP3, DivX, AVI, WMV and Quicktime files are copy-protected formats. > The list of banned filetypes includes more than thirty extensions. Some of them are bizarre: .IT files are banned — these are Amiga-style music modules composed with Impulse Tracker, a particularly well-loved tracking sequencer that hasn't been updated in almost a decade. I composed with IT myself, back in the day, and still have all my shitty compositions, none of which Western Digital would have me share. (Try MOD vs. Speak&Spell masterpiece Eddie Dreams of Women, if you dare: IT, MP3) > Isn't it cute how the only data it views as worthy of policing are music and movies? These are the only copyrights that matter under corporate monkey law. > It's the most astonishing example of crippled equipment I've ever seen. A DRM'd hard drive! Whatever next? Dreaming meat? > *UPDATE: The manual's appendix and online support site provide setup instructions for SAMBA, allowing access over IP instead of with the DRM-infested and poorly-reviewed client app, elsewhere claimed to be "required." * > *MOAR! Samba not enough? Gut the firmware and install made-to-measure Linux: An entire community of folks is here to help you hack your MyBook: mybookworld.wikidot.com. Internal formatting was stripped in the copy-and-paste process. I could add it back, but that would detract from the purity of the approach. ;D
• tyingq 5y ago
  My money is on "hardcoded admin backdoor password leaked". Edit: Found the manual[1] "Changing a User’s Password: When viewing details about a user, the Administrator can change the user’s password (no password is the default setting)." Oof. [1] https://media.flixcar.com/f360cdn/Western_Digital-905161691-4779-705058.pdf https://media.flixcar.com/f360cdn/Western_Digital-905161691-...
  • munk-a 5y ago
    Alternatively - a backdoor without any authentication requirements at all was discovered. There have been times when web crawlers have found pages with delete icons on them that are pointing to GET requests and, after dutifully following them to index the data, resulted in a server being wiped.
    • ExtraE 5y ago
      Anyone got a link?
  • nuker 5y ago
    > My money is on "hardcoded admin backdoor Mine are on UPnP and shitty firmware web server
• bobsmooth 5y ago
  A quick search through Shodan will reveal thousands of unsecured storage devices just sitting open on the internet. I'm really surprised it took this long for something like this to happen.
• sasaf5 5y ago
  I used to have one of those, and it bricked after a power outage. Luckly it only contained media I could download again. I opened it to try recovering my files from its HDD directly, but to my surprise it merges the HDD with a portion of internal flash in a single volume. I didn't try recovering it further because I didn't care of the data, but I was really expecting to see my files in that HDD... After that I ditched its mother board and connected its HDD to a raspberry pi.
• WalterBright 5y ago
  > “It is very scary and devastating that someone can do factory restore on my drive without any permission granted from the end user,” one user wrote. I'll say again: backup drives must have a physical write enable switch on them. To all the people who argue against this - just you wait till it happens to you! Not having multiple backups is also a very bad idea. One day my 8T drive slipped out of my hand and smacked on the floor. That was the end of it. But I wasn't out my data, just out the cost of another drive. Cloud backup is a stupid idea. At any moment it could go dark, for any reason, and you have no recourse. Might as well bare your throat and hand some random stranger a razor.
  • munk-a 5y ago
    > Cloud backup is a stupid idea. At any moment it could go dark, for any reason, and you have no recourse. Might as well bare your throat and hand some random stranger a razor. I really disagree - physical storage in your home is the common alternative for a lot of consumer users - and that physical storage will involve maybe unplugging your external hard drive between backups - but otherwise never checking for the consistency and accuracy of the data nor the hardware. If you're working in a data center then it's your job to do these things and it doesn't take very much time... for normal folks cloud backups are likely going to be more reliable.
    • WalterBright 5y ago
      > cloud backups are likely going to be more reliable I've seen enough HackerNews articles: 1. My account got deleted and I can't find a human to talk to and all my pictures going back 20 years are gone! 2. A hacker guessed my password and deleted my online presence! It's all gone! 3. My storage provider went bust and all my stuff is gone!
      • majormajor 5y ago
        If my cloud backup backend provider cancels my account, my backup software will quickly complain. There will be a window of exposure, but I can act quickly. If my backup harddrive is in the same house as my main storage and my house burns down, I'm fucked. If I'm fancy, I may have multiple backend storage providers, too. Lot easier to do that then to have multiple houses. I wanted to use a safe deposit box in the past, but last time I called banks near me, they didn't even have safe deposit boxes available to rent! I can ask some friends, but then will be limited in frequency of updates, still.
• scorxn 5y ago
  Almost bought one of these, but opted for a raspi and usb3 external drive instead. Works great with Time Machine. https://saschaeggi.medium.com/use-a-raspberry-pi-4-for-time-machine-works-with-big-sur-1e66a9650789 https://saschaeggi.medium.com/use-a-raspberry-pi-4-for-time-... was my guide, though I deviated by using ext4 instead of hfs, and didn't need avahi.
  • user982 5y ago
    Ext4 keeps all of the HFS+ metadata and resource forks?
    • weikju 5y ago
      When Time machine backs up over Samba, it creates a sparse HFS+ disk image bundle on the remote drive. File are not backed up directly to the ext4.
      • user982 5y ago
        Good to know, thanks.
  • snapetom 5y ago
    This is what I did, too. But use ext4 instead of HFS+, and use Samba instead of Netatalk. With HFS+, the bundle would get corrupt after a few days. With Netatalk, a sudden power outage would corrupt the whole thing. Don't listen to 99% of blog posts on this. They all tell you to use HFS+/Netatalk. None of those authors have actually used that backup solution for any extended period of time, because if they did, they'd find that it's unusable. Use this one instead: https://mudge.name/2019/11/12/using-a-raspberry-pi-for-time-machine/ https://mudge.name/2019/11/12/using-a-raspberry-pi-for-time-... Samba. Ext4.
    • jra_samba 5y ago
      Thanks for the recommendation. We work pretty closely with Apple's SMB2 client developers to make sure everything works well together with Samba. They're great fun to work with !
• rsync 5y ago
  I'm inclined to write off (anyone using a WD "My Book" device) as beyond help but a simple SFTP client like WinSCP or Cyberduck or Filezilla is comprehensible to just about everyone. You drag and drop to the SFTP destination[1] which covers "History"[2] with immutable ZFS snapshots and "Integrity"[3] with ZFS itself and "Security"[4] by running nothing but OpenSSH. If you're going to set your parents up with something, you could do worse than that ... [1] https://www.rsync.net/products/sftp.html https://www.rsync.net/products/sftp.html [2] http://taobackup.com/history.html http://taobackup.com/history.html [3] http://taobackup.com/integrity.html http://taobackup.com/integrity.html [4] http://taobackup.com/security.html http://taobackup.com/security.html
  • nightfly 5y ago
    I backup to cloud (b2, scripts that wrap their CLI tools), but there are lots of reasons to prefer backing up to devices they physically own.
    • DaiPlusPlus 5y ago
      I do both: I backup to my Synology NAS, which then in-turn uses Synology's Hyper-Backup (which is very nice, btw) to my Azure storage account - costs me about $15/mo to store a few terabytes with PITR recovery back to when I started doing this in 2018. The thing is... I can't help but worry someone's going to compromise my NAS and DBAN the drives and then extract the Azure storage key and use that to delete all my backup blobs... (Yes, the backup client needs read, write, and delete permissions, unfortunately - and Azure doesn't offer a Blockchain-style "append-only" mode for blob storage, unfortunately - still, better than nothing). UPDATE: Apparently Azure Blob Storage does support strict append-only blobs that cannot be mutated or deleted, only appended - so I wonder if Hyper-Backup can use that…
      • physicles 5y ago
        What’s your threat model? Is there anyone out there with $$$$ who will stop at nothing to part you, a rando, from your old data? Probably not. Are there sophisticated attackers who will burn a couple 0-days to build a botnet for the sole purpose of randsoming NASes AND attached cloud accounts AND the origin systems, accounting for tons of possible configurations? Still pretty unlikely — this is NotPetya level stuff with small payoff. If you find yourself in the crosshairs of a sophisticated, dedicated attacker (perhaps one in possession of a 0-day), you’re pretty much done. Offline write-only backups stored offsite are the only defense. However, is there a bug lurking in Hyper-backup that might accidentally wipe stuff from Azure storage, and the bug hits a month before your house gets struck by lightning? Maybe…
• ineedasername 5y ago
  Discontinued in 2015, so no security patches. That's the problem with all of these purpose built IoT devices, a general lack of security updates even when they're still supported, and of course no chance at all if 6 months or a year after you buy it they decide to drop the product line.
  • 1-6 5y ago
    "Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available." I'm using a WD My Cloud for non-essential data. I was wondering if my unit would be affected as well. As far as I can tell, the latest firmware update completed January 01, 2020. I'm safe for now but I better build something more robust.
  • kwyjobojoe 5y ago
    It runs Linux, and they could have at least opened up the firmware for opensource updating. WDs response to Windows 10 blocking network access because the My Clouds use an old version of SMB is to buy a new one (and trash working equipment) or enable a not particularly secure SMB version in Windows.
• ineedasername 5y ago
  Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors". I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't expose individual device ports to the world unless the user sets NAT for that. Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? If so, someone simply cracked bad security 6 years out of date and scanned for devices. Given typical IoT security, it might only have been using the default user & password.
  • mr_toad 5y ago
    > Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? I doubt it. The specs list UPnP support. DLNA on some versions too. No consumer device is going to expect the average punter to mess with NAT.
    • ineedasername 5y ago
      I wasn't sure because apparently there can be issues with multiplayer or online play with some game consoles and people will be directed to mess about in their router settings. There were some stories about problems with the Xbox like that.
  • ianmf 5y ago
    These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.
  • userbinator 5y ago
    The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT. If so, someone simply cracked bad security 6 years out of date and scanned for devices. Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.
• theo-born 5y ago
  This is not a good look at all, boo WD, boo
• deleted 5y ago
  [deleted]
• Vaslo 5y ago
  Cant give unRaid enough props if you want to replace your WD - changed my life for storage, media, networking, amongst lots of other things.
• 14 5y ago
  I just bought a large external hard drive for exactly this reason in case things fail. I did not use this live feature but I feel much better with an offline copy of my data safe. This lesson has been played time and time again when will people learn? You need to be in physical possession of your data and if it is truly critical you better have a second copy kept in another location in case of theft or fire.
• PaulHoule 5y ago
  With all the attacks going on I am going to tell spammers I’m sending the delta force after them.
• dannyobrien 5y ago
  maybe the HN headline should be edited to specify that this is WD My Book Live that was affected.
• jasonkester 5y ago
  So I have a Schroedinger's MyBook Live in front of me that I disconnected after reading this. I can probably live with it having been wiped, but what is the current wisdom on how I should proceed? These devices have no way to read from them via USB (which is why I never liked the thing), so the only way to peek in and see if my stuff is still there would be to plug it into the router and power it on. I presume doing that would get it wiped today. Should I just leave it in its current superposition of wiped and not wiped until a fix comes out?
  • mathieubordere 5y ago
    (With the risk of stating the obvious) Can't you access it over the local network if you plug out the internet connection of your router?
  • dubya 5y ago
    I doubt a fix is coming. Just keep it from reaching the Internet long enough to disable the cloud features. A patch cable directly to the PC should work.
• vmception 5y ago
  The next season of Black Mirror should just be stuff that actually happened instead of just plausible futures
• villgax 5y ago
  Folks, buy 2 similar drives & backup stuff monthly to both & have your local workspace synced to another machine local or cloud using any tool like rsync, Cyberduck, iCloud whatever.
• bigiain 5y ago
  "The My Book Live device received its final firmware update in 2015." A unpatched in 6 years linux device directly connected to the internet? What could possibly go wrong? "There is no IoT, there is only the internet of unpatched linux boxes."
  • nhoughto 5y ago
    doesn't appear to be a directly connected to the internet problem, even NAT'd stuff wiped data.
    • dcow 5y ago
      That's not how C2 servers work. Connected to the internet means connected to the internet.
    • martyvis 5y ago
      By definition "directly connected to the internet" means if a device can on its on accord, direct requests to an entity, ask it a question, and act upon it is true. From what I understand these WD boxes go to a management service in the cloud. and were told they should factory reset. Whether something is pull-only (as in this case) or push (say allows HTTP or SSH access from a random on the internet) is irrelavnt if either result in unauthorised activity on a box in your home.
      • haswell 5y ago
        In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall. For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”
        • bigiain 5y ago
          How good do you reckon a 6 years past EOL consumer linux device's defences against a browser running 3rd (or 1st) party javascript making http requests to http://192.168.0.1..254]/cgi-bin/factoryRestore.sh http://192.168.0.1..254]/cgi-bin/factoryRestore.sh? How much would you bet against that being an unauthenticated call or one with leaked hard coded reds?
• fallingknife_ 5y ago
  Read this, then checked my old My Book Live. Sure enough... everything's gone. I just used it for continuous laptop backups over my LAN, so unless one of them crashes tonight, I should be good. But, this will certainly give me pause when considering WD products, and this type of product in particular. This is very bad, WD! Are your other products also vulnerable in this way? Why should anyone ever again trust your company to keep their data safe?
  • Wowfunhappy 5y ago
    > Why should anyone ever again trust your company to keep their data safe? Because if you need a hard drive, your options are pretty much Western Digital, Seagate, and Toshiba, and they've all had their own problems.
    • R0b0t1 5y ago
      Seagate mitigated their most famous problems. They were a good bargain buy for a while after that as they tried to rebuild their brand. Issue is now they're too proud of themselves, you're better off buying something else. They might still be the cheapest per GB for certain sizes, just look at the backblaze stats.
      • cortesoft 5y ago
        What does "too proud of themselves" mean?
      • broknbottle 5y ago
        Seagate Exos drives are solid. All of HDD drives intended for consumers are 1 year warranty bottom of the barrel shit
        • chris11 5y ago
          One option is shucking a high capacity external. Those are more likely to be high quality. Some are rebranded enterprise drives. But the hd model isn't guaranteed, and warranty support might be iffy.
• thrdbndndn 5y ago
  Can we add "Live" to the title, please?
• dcow 5y ago
  "Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available." - Western Digital
• unlog 5y ago
  Could this happen if your router is not open to the world? I dont get it to be honest, maybe the device sends queries commands home? that seems unlikely
  • ExtraE 5y ago
    The article says you can manage them from a WD site.
• deleted 5y ago
  [deleted]
• landemva 5y ago
  Off-topic: for at least a year arstech has been filled with stories about the 'rona and "oceans gonna rise soon". I'm going to blackhole their domain on my network.
• deviation 5y ago
  In other news- now is the perfect time to invest in a MyBook. The price will plummet now, and WD will receive such a reaming from this incident that it will never happen in the future... Hmm..
  • tommoor 5y ago
    The prices of MyBook's have been through the roof the last few months because of Chia[0] farming. Most models literally cost almost twice what they did 6 months ago [0] https://www.chia.net/ https://www.chia.net/
• jaquers 5y ago
  What is the attack vector here? Malware running in user-space or remote commands from the (compromised) mothership?
• zmmmmm 5y ago
  Hopefully this flushes out the elephant in the room of the irresponsibility of manufacturers selling devices like this and then leaving the software unpatched / unupdated within a year or two of selling it. Unfortunately this needs to become regulated. Either commit to "lifetime" updates (at least 10 years) or be forced to put a massive warning on the label advising the secure period for which the product can be used. Just like food has expiry dates, so too do these devices need them.
  • MattGaiser 5y ago
    That just effectively means a subscription. So your hard drive will be $100 + $10 a month.
    • emodendroket 5y ago
      If I'm going to pay a subscription fee, why am I even bothering with an on-premise solution really.
      • MattGaiser 5y ago
        I think if long term support is your thing, ownership doesn't really make sense for anything. Ownership is always going to come with a certain level of do it yourself.
      • deleted 5y ago
        [deleted]
      • Spivak 5y ago
        I find it funny that we simultaneously work in places that understand that software requires constant maintenance and charge customers a recurring fee for it while being gobsmacked that we have to pay indefinitely for the same. You go on-prem for the same reason you work does. Because the software licensing plus the amortized cost of hardware is less than the subscription.
        • emodendroket 5y ago
• amanbolat 5y ago
  Don't put all your eggs in one NAS. I alway do scheduled backups to online cold storage like Amazon Glacier.
  • shash 5y ago
    And a physical backup onto removable media.
• zmmmmm 5y ago
  Just imagine if this also applied / applies to the firmware in their hard drives or associated OS drivers ....
• shash 5y ago
  There’s a difference between MyBook and MyBook Live. The Live version (this article) is ONLY accessible over the cloud service for some reason. Even if you’re on the same LAN there’s no SMB, FTP or anything else. Only the cloud connection. The MyBook is a more normal NAS. Bought one of these for my dad few years ago without noticing the difference. Cheap, hobbled and bricked itself more than once. Even without this incident, would not recommend.
  • cmeacham98 5y ago
    Seriously? What's the point of owning the hardware then, might as well just use Dropbox? Seems like you take on all the risk for essentially no benefit.
    • gruez 5y ago
      >What's the point of owning the hardware then, might as well just use Dropbox? Seems like you take on all the risk for essentially no benefit. Dropbox costs $120/year for 2TB. WD live looks to be a one time purchase price for however many terabytes you want.
      • cmeacham98 5y ago
        To be honest, I just assumed the "Live" service was a subscription but it actually does appear to be one-time. I should note, however, that it seems the drive is built in and not easily user replaceable/swappable, so it's not really "however many terabytes you want".
      • thebean11 5y ago
        Hard drives are consumable devices. Dropbox sounds like a better deal considering you get redundancy, don’t need to replace drives when they fail, can recover deleted files for some amount of time (I think)..
        • Spivak 5y ago
          This is much much less of a problem for consumer workloads. A pair of hard drives can last a household a decade of moderate use without needing replaced.
• brailsafe 5y ago
  MyBook is an awful product anyway. In older ones that I needed to recover some data from, the power supplies would fail quite quickly. Cheap drives, cheap components probably, cheap enclosures. Hopefully the drives weren't zeroed out in this case, so inexpensive data recovery can be used.
• Little_John 5y ago
  Nothing online cannot be Perverted. Use Hardware and Smile.
• Little_John 5y ago
  Bye.
• dlsa 5y ago
  Hmmm. I have one of these drives sitting on my desk. Hasn't been powered up for weeks. Do I disassemble it, take the drive out and grab the data that way or just wait? What are these things formatted as? Schrödinger storage: data is both lost and found. Edit: This isn’t the Live version. I think its going to be in pieces Real Soon.
  • dlsa 5y ago
    Some further light reading before I pop the case and possibly discover hardware encryption preventing straightforward usage. https://github.com/themaddoctor/linux-mybook-tools https://github.com/themaddoctor/linux-mybook-tools
• shimonabi 5y ago
  When I purchased a My Book about 15 years ago, the drive was hardware encrypted by the controller board. That means even if no password was set, if you didn't use it with the WD controller board, you couldn't access your data. I threw the case away, sold the controller board and formatted the encrypted 2 TB drive with ext4. I'm still using it for backups. I have a restic script that also backups the data to Backblaze.
• ivraatiems 5y ago
  According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo https://www.westerndigital.com/support/productsecurity/wdc-2... [2] https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/CVE-2018-18472
  • gertrunde 5y ago
    From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.
    • busymom0 5y ago
      I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.
      • zamadatix 5y ago
        There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse. You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early. You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all). You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways. . Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.
• throwaway45829 5y ago
  [ - Proof of Space - ]
• rantwasp 5y ago
  Can't wait for my 3$ as compensation for losing all the data. Seriously now. A class action lawsuit should end with the culprit being out of business in cases of extreme negligence like this one. Anything less just incentivizes them to weight "risk/benefit" of not doing anything
  • xyzzy123 5y ago
    This has never happened before and could seriously ruin the brand. [EDIT: widespread, very public data loss with a remote cause, as a result of a firmware vulnerability in a product whose job is to store data]
    • nebula8804 5y ago
      What I am seeing is future deep discounts on WD Drives.
      • CaptainZapp 5y ago
        Maybe. But I'm not sure if there are any takers. My data is much more important than a 50$ rebate on a storage device.
    • xvector 5y ago
      I hope it ruins the brand. This sort of incompetence and gross negligence ought to cripple companies.
      • CrendKing 5y ago
        If WD is gone, are you going to buy drives from Seagate, seriously? I've had 3 hard drives from Seagate just fail by itself before, 0 from WD so far. HGST used to be good, but sold to WD. I have no experience with Toshiba, but they have less product diversity and higher price.
        • deleted 5y ago
          [deleted]
• rvz 5y ago
  Imagine if your cryptocurrency wallet or passwords was on this cloud only system. It is designed to backup your data on the cloud and then it deletes it instead. Not even their cloud is doing well for its self then. Exactly why I kept on pushing for self-hosted systems; in this case a local NAS.
• wly_cdgr 5y ago
  A good reminder always to have a minimum of two completely offline backups for any data you actually care about
  • fallingknife_ 5y ago
    yes, 2 of these WD My Book Live's would have assured data integrity. Oh, wait....
    • wly_cdgr 5y ago
      I said OFFLINE backups
• Scoundreller 5y ago
  Sounds like files are all still there, but directory structure is all gone. So everything is recoverable, just very disorganized: https://i.reddit.com/r/techsupport/comments/o71ls4/comment/h2xw94g/ https://i.reddit.com/r/techsupport/comments/o71ls4/comment/h...
  • toast0 5y ago
    If they're recommending PhotoRec, it means it was either rm -rf / or a quick format. Your data is there, but the directories aren't there, and any file that wasn't written in a single extent is going to be awfully hard to piece back together.
    • Scoundreller 5y ago
      > any file that wasn't written in a single extent is going to be awfully hard to piece back together. Oh that’s not going to be good.
• killjoywashere 5y ago
  This just goes to my general theory that you have very few options: 1) you (inside your walls) are fully NIST 800 series compliant (good luck) 2) you trust Google, Apple and other blue chip companies whose entire brand depends on protecting their user data 3) just accept being a chump
• geomark 5y ago
  So one wouldn't want to have an NAS with WD products (although the bare drives are fine). Is Synology the only good option now? Seems like a good time and place to ask if anyone can link to a good tutorial on a good NAS setup.
• saltedonion 5y ago
  How is this even possible. Shouldn’t these devices be behind a NAT? How did the hacker even reach these devices.
  • fulafel 5y ago
    NAPT is for facilitating internet traffic despite shortage of ip addresses, the opposite of a firewall in a way. So it's a success, not a bug, if it manages to enable some incoming traffic.
• maltris 5y ago
  I did not read anything about the MyCloud devices yet. Is the firmware same and the MyCloud EX4 affected, too?
  • maltris 5y ago
    Just blocked the device off, just in case. Last firmware from 2019.
• JamesBrooks 5y ago
  Was very worried when I checked through the 5x 3TB My Books I have to find that all the data was ok - which I thought was odd as they're very old models. Turns out at the start of COVID I re-did my home networking and the gateway addresses on all the My Books were incorrect, so they haven't had internet connectivity for over a year... (quickly adds extra firewall rules to prevent them for bonus safety).
  • vanderZwan 5y ago
    Do you have "My Book" or "My Book Live"? I also have a bunch of external hard drives, but I think they're older than the whole Live bit.
• dang 5y ago
  Other related thread: Help All data in WD mybook live gone and owner password unknown - https://news.ycombinator.com/item?id=27625925 https://news.ycombinator.com/item?id=27625925 - June 2021 (66 comments)
• xpressvideoz 5y ago
  It seems to be a bad idea to buy commercial NAS devices, because eventually, every device would go end of life. Better build a DIY device with an open firmware. But thinking again, this kind of approach wouldn't be applicable to typical ordinary people. Then I guess the next better thing would be to force NAS devices to stop accepting Internet-facing connections after their support period ends. Every device has a defined lifespan which dictates how long it can work without sacrificing quality. As a device dealing with important data, NASs should be given higher restrictions.
• Pxtl 5y ago
  I wonder how this happened. I mean, most of these devices are going to be behind NAT, which isn't perfect security but does mean the device has to basically go looking for trouble to get hacked. I mean theoretically a vulnerable device on your network that doesn't actively seek out connections is risky but it shouldnt see this kind of total across the world compromise.
• Pxtl 5y ago
  I'm so happy that my only WD nas drive is a dumb external drive hooked to a Raspberry Pi.
• cube00 5y ago
  It will be interesting to see if these kind of cases increase once we move to IPv6 and no longer have NAT protecting us.
• layoutIfNeeded 5y ago
  Good. Laypeople need to be weary of IoT crap.
• midrus 5y ago
  Is there any modern, reliable replacement for the old "Time Capsule" from Apple? I have a home server with samba, etc where I'm pushing Time Machine backups, but I'd prefer something standalone that doesn't require much setup. What are others using for this?
  • ksec 5y ago
    None. And I want one with iOS / iPadOS Support!
  • neop1x 5y ago
    I have a small "normal pc-like" box with up-to date Linux. It required some initial setup but it will be supported forever and almost any software can be installed there.
    • midrus 5y ago
      Yes, that's my current solution. But I'd rather have something fanless, with internal drives and no need to setup linux and/or samba, etc...
  • verisimilitude 5y ago
    I think what people do right now is an always-on Mac Mini with external drives connected. The Mac Mini strategy introduces a failure point at the USB->hard drive connection. Pretty low-maintenance, until the $3 USB thingy dies! Apple's exit from the router business came at precisely the wrong time: they could sell an integrated smart home / mesh network / router / local+cloud backup that also provided macOS/iOS/tvOS software update caching / content caching. My guess is they didn't do it because they felt they could make more money charging for cloud-only services (they love their services revenue) rather than selling networking devices.
• scrapcode 5y ago
  There are a lot of comments on the situation itself, or the companies involved when these type of events happen. Speaking of evolutionary behavior as a whole, why does the industry still keep driving towards IoT / IaaS when events like these are becoming more common? Is there real risk analysis going on that determines that putting crucial operational infrastructure in the hands of a vendor is worth the consequences? I know this particular event is related to a consumer product, but consider how a lot of businesses work. Once a solid system is built, there's no reason to change it - hence the abundance of legacy systems in finance etc. It makes me feel like these things could eventually go full-circle and companies will value owning their own datacenters. It may also make more financial sense for companies that have recently realized a lot of savings in office space leasing that they could pivot into infrastructure.
• sandeep1338 5y ago
  this is interesting. Usually EoL devices is not really updated all the time.
• techer 5y ago
  Mine all gone too. I imagine I’m backed up twice. Who knows.
• karlkloss 5y ago
  I never trusted commercial NAS, I don't even trust OS NAS distributions, they all have their own problems. Just use standard hardware, a standard Linux distribution, and learn how to configure it. Convenience is always bought with security.
  • hughrr 5y ago
    I'm with you on this. I don't run a NAS and never will.
  • deadbunny 5y ago
    Yup. 1. Install ubuntu 2. sudo apt install nfs-kernel-server 3. zpool create foo /dev/disk1 ... /dev/diskX 4. vi /etc/exports
• j4hr0m 5y ago
  This also happened to me under Windows 7. Never let any company mange your data.
• Nuzzerino 5y ago
  The WD My Book software seemed antiquated and not user-friendly. Not surprised to see this happen.
• drosan 5y ago
  "S" in "IoT" stands for "security".
• jokoon 5y ago
  Insurance companies should try to hire experts to improve digital security of their clients, and then sell some insurance covering this kind of loss. I'm not really fond of insurance companies, but as long as there are no solid and MANDATORY security standards and practices put in place, nothing will change. Maybe government should just inspect and validate the sale of software if it's secure enough. Of course the process will involve more work, but it's not like the silicon valley cannot pay for this. It's like we're at an age when the seatbelt and speed limits are not even made into laws, and we're still somehow surprised of accidents.
• msiyer 5y ago
  WD screwed up. However, users must have a backup policy for when (not if) data hits the fan. For important data, having multiple onsite copies with few of them totally dumb (as opposed to smart IoT) and multiple offsite copies should become a habit.
• deleted 5y ago
  [deleted]
• tibbydudeza 5y ago
  Afaik their accessible remotely over the internet via the WD MyCloud was just a custom daemon running in the background on the device. Suspect there was a remote backdoor most likely for tech support.
  • tibbydudeza 5y ago
    Even worse it was a known CVE - the firmware update was in 2015. Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands.
• danielrpa 5y ago
  WD needs to patch this, but I always recommend people to also have a cold backup of their data. I make a back up of everything I have every 6 months, rotating my target backup device (an external HDD) through a simple command line script. While not 100% hacker proof, it's a lot safer than relying on internet-connected devices.
• peterhil 5y ago
  No surprise. WD My Book was the worst purchase of my life. The dual RAID hard drive just started clicking one day, and no data could be read after that. Apparently using only one drive was not possible on hard drive failure or the controller failed. (I did not physically try to remove the other drive as the drives were somehow coupled, maybe mirrored RAID mode was not even possible) This was about ten years ago. I would not touch another Western Digital product after that.
  • theshadowknows 5y ago
    Happened to me too!
• isenbaevitmo 5y ago
  and chia-mining have started
• londons_explore 5y ago
  For most users, this device wouldn't be directly exposed to the internet... it would be behind NAT on peoples home WiFi networks. I find it hard to believe that even a critical unpatched vulnerability in the client device could be mass exploited like this. I suspect the "cloud services" are somehow at fault...
• swiley 5y ago
  I remember the first time I saw this and thought "oh a lot of people are going to be sad in 10 years."
• willj 5y ago
  Can you imagine if someone had kept their crypto wallet in this thing?
• flyinghamster 5y ago
  I've said it before and I'll say it again: consumer tech sucks. From routers and NASes with back doors to lighting systems and thermostats that "need" someone else's computer to function (as though their onboard CPU isn't more powerful than yesteryear's PCs), "caveat emptor" couldn't possibly be more true. Even though I enjoy building my own systems, it's a crying shame that I have to build my own whether I want to or not, and even Micro Center doesn't carry server motherboards with IPMI and a BMC.
• xyst 5y ago
  There is going to be a massive lawsuit against WD soon. Sounds like a bad update was pushed to these devices.
• gccs 5y ago
  Hopefully the SEC is looking for people that shorted WD before this stunt occurred. It would not surprise me if some group developed a worm to deleted all the data to cause a dip in market price.
• fulafel 5y ago
  All this IOT business got off on the wrong foot. We knew 20 years ago how vulnerabilities turn up. So we've also known that designing something to withstand the hostile internet many years into the future would require an entirely different approach to software engineering than taking commodity software and flashing them in with some integration of custom bits. But nobody stopped the vendors and it was cheaper than the competent alternatives.
• Diaz74 5y ago
  it is a sad story
• tzfld 5y ago
  More and more convinced that the best data backup is a read-only one, and not connected to the internet. Optical disks will have their use, even if they will not be mainstream anymore.
• pmlnr 5y ago
  One lesson I see here is that software-only triggered factory resets shouldn't be a thing. Routers used to have reset pins/buttons which had to be held down for a while to make them factory reset. That should be the _only_ option to factory reset a device that wipes user data along with it.
• m-p-3 5y ago
  This validate my choice of hosting my own home file server through a standard PC instead of going the cheap route of a basic NAS. At least I remain in control of the OS and can ensure it is patched.
• teakweazel 5y ago
  Why does everything have to be connected to internet? DoD missiles, Hospital ekgs, hard drives.
• zelon88 5y ago
  I can't believe we're just glossing over the fact that everyone who has been compromised probably has an intruder still sitting on their LAN, or at least a big hole in their network somewhere. The request came from somewhere, and most people don't willingly forward ports to these devices. You're all worried that the data is gone, maybe you should be worried that someone might have taken it.
• oldgradstudent 5y ago
  WD My book Live updates were always problematic. There was one update where log files filled the root partition preventing the device from booting. I had to remove the drive from the enclosure, and connect to a computer to recover the device. They did refund it and not asked me to return it, but it wasn't encouraging.
• bigpoppa 5y ago
  McAfee must of kept the 31TB on a MB Live drive.
• riobard 5y ago
  The WD My Book Live series NAS has two models, a single-disk one called just My Book Live where the disk is not user-replaceable, and a dual-disk one called My Book Live Duo where the two disks can be replaced tool-free. AnandTech had a pretty thorough review of the single-disk one https://www.anandtech.com/show/4952/wd-my-book-live-network-attached-hard-disk-review https://www.anandtech.com/show/4952/wd-my-book-live-network-.... I had the MBL Duo. It ran on an 800MHz Applied Micro APM821XX PowerPC processor with 256MB RAM. The stock firmware was a customized version of Debian. I couldn't remember exactly which version of Debian but it's definitely older than Debian 9. Maybe 6 or 7? Anyway, you can enable SSH access via web UI and directly login to the device and see everything running there. IIRC WD used OpenVPN to establish a connection to their servers to allow remote access to these devices behind NAT and firewalls. I had always been wondering what if their servers were hacked and then hackers could theoretically access the NAS via that VPN connection and by extension my LAN behind firewalls so I disabled the remote access feature. A couple of years back I finally got tired of the ancient Debian, and since WD had already deprecated the device without further updates/patches, I was looking for alternatives. There were people on WD forums trying to compile and install newer versions of Debian. But since the device does not have video out or console port, it was very easy to mess up and got bricked. Eventually I found OpenWRT (yes, the linux-based router OS) had official support for both MBL models (https://openwrt.org/toh/western_digital/mybooklive https://openwrt.org/toh/western_digital/mybooklive) and the installation seems pretty safe (especially for the Duo with replaceable disks). So I went with OpenWRT and never looked back. My MBL Duo now sits at my parents-in-law's place running OpenWRT. I had setup WireGuard to connect it to my LAN in another city and used it as a remote backup destination in case of either place catching fire or whatever other disasters. And now I feel pretty lucky for my decision to ditch the original firmware. Good riddance!
• blue1 5y ago
  It's hard to have a great opinion of WD after: (1) this, (2) the SMR disaster of supposedly NAS HDDs, (3) the portable drives silently encrypted even when no encryption was set.
• ChicagoDave 5y ago
  Looks like I had the "Update My Device" setting off. Whew. I have 20 years of kids photos and videos, though I'm nearly positive I've backed this up and shared it with my ex-wife. Nearly had a heart attack when I saw this. Though mine is the WD MyCloud device. I have a MyBook one too, but it's offline. Is the MyCloud device included in the issue?
• pnutjam 5y ago
  PSA Your data is not secure unless you have 3 copies. 1. working copy 2. backup 3. archive END PSA
• sjg007 5y ago
  Hmm.. is My Cloud affected as well?
• bokohut 5y ago
  These are only storage devices, albeit EOL and no support or updates, but they still just work until... I anticipate to read in the near future about lawsuits around people losing their crypto access keys as well as entire business' closing from loss of their data. Now consider the coming IoT flood that will also undeniably include medical devices, some of which will directly keep individuals alive AND be connected. In time this will redefine the phrase "End of Life". Uncle Bob 1990-2042 Uncle Bob was a great human, had a great family and did great things in his community. Uncle Bob however failed to maintain his personal security practices and his medical device was compromised as a result therefore leading to his EOL. RIP U Bob. Certainly unfunny dark humor derived from what is certain to come. The real problems are just 'warming" up.
• MarkusWandel 5y ago
  What I haven't seen in a superficial reading of this thread: Did the device really erase the data? A quick way to do this, nowadays, is to encrypt it and, upon reset, throw away the key. If it's an old school quick format, some types of data can be recovered. A tool like "photorec" can scan the drive and recover pictures, MP3 files and so on, mind you without original metadata like file names and dates. May be better than a total loss.
  • quenix 5y ago
    I might be wrong, but isn't the "encrypt everything & delete key" method -way- more difficult to recover from than an actual disk wipe? I mean, with a disk wipe, you can still try to recover some data using data forensics tools. If they key is done, you can have the best forensics team in the world, you can't decrypt the garbled data.
• ChrisArchitect 5y ago
  This has an official security notice now https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo https://www.westerndigital.com/support/productsecurity/wdc-2... that references a NIST vulnerability report https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/CVE-2018-18472 ..that references the original bug report that WD refused to address due to warranty stuff etc. https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/ wow.
• wingman-jr 5y ago
  I have a WD MyBook and unplugged it last night - still fine, fortunately. I ssh'ed in and renamed the factoryRestore.sh and wipeFactoryReset.sh to cripple the attack as well as removing one drive from RAID until I can get an airgapped backup. However, that doesn't fix the actual vulnerability itself. Anybody else affected have a suggestion for how to e.g. upgrade the relevant packages to make this secure?
• YuccaGloriosa 5y ago
  Not just WD... Seagate Dino's NAS interest too As of May 15, 2021 the Seagate Access feature of Seagate NAS products will be discontinued. Specifically, the Seagate Access service, Seagate Access through Seagate Sdrive, Seagate Access through Seagate Media App, and Seagate MyNAS will no longer be available after May 15, 2021 at midnight Central European Time. Additionally, customer support for the Seagate Access service will also be discontinued. The removal of this service means that access to all Seagate NAS devices via the Seagate Access web portal, Seagate Sdrive, Seagate Media App, and Seagate MyNAS will no longer function. However, you will not lose remote access to the files on your Seagate NAS since it can be configured and accessed using the FTP/SFTP service. Similarly, your Seagate NAS will not change for standard network access within the home or office network using common network protocols on macOS and Windows. Please know that we remain grateful for your purchase of a Seagate NAS and hope you continue to enjoy it despite this change to remote access via Seagate Access, Sdrive, Seagate Media App and MyNAS. For questions, please contact https://www.seagate.com/contacts/ https://www.seagate.com/contacts/. Cordially, The Seagate NAS Team
• BrandoElFollito 5y ago
  I am not sure if I understand correctly that this product is not maintained (EOL) since 2015? So officially not receiving any updates since then? If so I am not sure what people complain about. If my understanding is incorrect then WD behaviour is to blame (at least people should get money as compensation for the lack of due diligence from WD). Now, if someone's life depends on the data, having it in one place only is crazy.
• greyhair 5y ago
  This all goes back to the fact that cloud based / cloud connected storage, that is not also backed up on disconnected media, is essentially insecure/unreliable. I have cloud accessible storage that is backed up on two separate 2TB USB drives, in A/B fashion. For me, 2TB is enough to cover my irreplaceable data (mostly digital photos).