4 ms·

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voic

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors". I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't expose individual device ports to the world unless the user sets NAT for that. Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? If so, someone simply cracked bad security 6 years out of date and scanned for devices. Given typical IoT security, it might only have been using the default user & password.

mr_toad 5y ago
> Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? I doubt it. The specs list UPnP support. DLNA on some versions too. No consumer device is going to expect the average punter to mess with NAT.
- ineedasername 5y ago
  I wasn't sure because apparently there can be issues with multiplayer or online play with some game consoles and people will be directed to mess about in their router settings. There were some stories about problems with the Xbox like that.
ianmf 5y ago
These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.
userbinator 5y ago
The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT. If so, someone simply cracked bad security 6 years out of date and scanned for devices. Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.
gcbirzan 5y ago
Judging by the CVE they linked, you need local access. But, since it's a GET parameter, this could be a drive by attack where someone puts all the links to common home networks in a page and the browser just takes care of that (and there are ways to guess the local network). Though, judging by the number of people affected, it might be something else.

mr_toad 5y ago

> Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? I doubt it. The specs list UPnP support. DLNA on some versions too. No consumer device is going to expect the average punter to mess with NAT.

ineedasername 5y ago
I wasn't sure because apparently there can be issues with multiplayer or online play with some game consoles and people will be directed to mess about in their router settings. There were some stories about problems with the Xbox like that.

ianmf 5y ago

These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.

userbinator 5y ago

The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT. If so, someone simply cracked bad security 6 years out of date and scanned for devices. Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.

gcbirzan 5y ago

Judging by the CVE they linked, you need local access. But, since it's a GET parameter, this could be a drive by attack where someone puts all the links to common home networks in a page and the browser just takes care of that (and there are ways to guess the local network). Though, judging by the number of people affected, it might be something else.