10 ms·
Help All data in WD mybook live gone and owner password unknown
- petee 5y agoOne users quote: "The WD MBL log files indicate a script issued “FactoryReset” command to users all over the world. I don’t use Cloud Storage so I don’t understand how this can happen?" Oh boy... plus side is other users said data seems to be potentially recoverable
- SilverRed 5y agoIoT once again proven to be a horrible idea. Hardware OEMs can't be trusted with security. They can hardly make a product that holds up to normal use, let alone malicious attacks.
- beprogrammed 5y agoIf only they would give into open firmware. Less work for them, probably better software in the long run.
- NegativeLatency 5y agoI agree with your point however I’m sure there’s some analyst or someone who thinks they’d be losing out on services revenue or something equally short sighted
- beprogrammed 5y agoSay your going to open your firmware, and who ever stands up to oppose it, fire them! There standing in the way of progress. On a serious note though, it's kind of a double edge sword, you still have to provide firmware "I bought this device and I can't even use it without downloading something from the internet...!!!" or "The firmware I downloaded off the internet stole my wife and burned down my house!"
- NegativeLatency 5y agoThe wild and still somewhat enduring success of the linksys wrt54g seems like it would be enough to get some companies to do it.
- mjevans 5y agoFor this product class, just build something that OpenWRT runs on; yes even for a NAS. If chips support / blobs / etc aren't there, get them on the way to being up-streamed and public. This was fairly obvious a decade ago, and today it should be planly obvious.
- SilverRed 5y agoI went through this process. Got a little nas device that had linux support. Unfortunately the performance was not good enough for SSHFS and it didn't have enough performance to run any kind of web ui like nextcloud. Eventually got a full power server which could run nextcloud but the hassle of keeping it running, managing backups, and just the cost of the power usage to keep it running made it much more cost and time effective to just use google drive and have all of these problems solved for me. Google may not be the most trustworthy but I at least trust my data is backed up and safe from hackers.
- femto113 5y agoThe fact that these are decade old devices that haven't had a firmware update in over five years yet are still so integral to their owners' lives that people are keenly feeling their loss suggests to me that they were not a horrible idea, nor poorly engineered. I have a WD MyBook World (not connected to the internet) that's probably the oldest still operating piece of computer technology I own--outlasting many computers, phones, tablets, etc. My family uses it to listen to music or watch movies all the time, and the fact that it "just works" and supports simple IoT/UPnP protocols is the only reason that's viable--no way could I convince my spouse or kid to use it if they had to go through the same pain I experience trying to stream something from my laptop.
- Groxx 5y ago>I don’t use Cloud Storage so I don’t understand how this can happen? Sounds like for at least some of them, the IoT part was purely a negative as it's solely responsible for their lost data. The storage is effectively integral to all of them, yeah. Not necessarily the IoT.
- deleted 5y ago[deleted]
- jspaetzel 5y agoImagine running `rm -rf` and not just wiping out your data, but all of your customer's on remote devices too.
- ric2b 5y agoI would just sell everything I own and go try to survive in some large forest where no one can find me.
- ketamine__ 5y agoLooks like a massive attack. I wonder if the goal of the attacker is to short the stock.
- actually_a_dog 5y agoShort interest on WDC isn't absurdly high, so, if that's the motivation, it's a pretty risky move to make not a lot of money. https://www.nasdaq.com/market-activity/stocks/wdc/short-interest https://www.nasdaq.com/market-activity/stocks/wdc/short-inte...
- Jarwain 5y agoYou don't need short interest to make money shorting the stock. Short interest is useful for trying to squeeze people shorting the stock. To make money off shorting the stock, all you need is for the stock to drop in price
- gruez 5y agoI think his point is that the short interest is low, therefore it's not that heavily shorted, so if the attacker was doing the hack and shorting the stock to make money on the dip, he wasn't shorting enough to make that much money. Either that, or the attacker didn't short the stock in the first place.
- weird-eye-issue 5y agoThat would be a silly point. Puts don't even show up in the short interest and are a great way to short a stock.
- gruez 5y agoThey do, indirectly because market makers hedge the puts they sell by shorting the underlying. https://www.investopedia.com/terms/d/deltagamma-hedging.asp https://www.investopedia.com/terms/d/deltagamma-hedging.asp
- villgax 5y agoIncoming lass-action lawsuit in.......3.......2....1
- hh3k0 5y ago"3 years of work gone? Here's your $5 -- don't spend it all at once."
- nn3 5y agoIt'll be $2.19 after lawyers fees, but only if you fill out a hour worth of paperwork.
- 29083011397778 5y agoAnd that sucks for those affected, you're right. But sometimes the point isn't to make the consumer whole (and I'm curious how one would you even come up with an average price for everyone affected anyways), but to make a statement that this is not okay. This would at least give a hypothetical Seagate engineer some real-world example to push back against phoning home for a HDD. It doesn't help here, but it can set an example (implying larger fines for the next company to screw this is), and hopefully prevent other companies doing the same thing.
- haswell 5y agoActive discussion here: https://news.ycombinator.com/item?id=27624735 https://news.ycombinator.com/item?id=27624735
- villgax 5y agoLTT is gonna have a field day on this one!
- dcow 5y ago"Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available." - Western Digital
- silly-silly 5y agoNow imagine how car manufactures are going to be able to deal with this in a few years. This shit is coming.
- echelon 5y agoYou're posting this on the site where many people want to subscribe to cars as a service. We're getting what we deserve.
- a_t48 5y agoIsn’t that just leasing?
- hardwaresofton 5y agoYeah but leasing the physical car normally meant you got the car and all associated functionality, for the duration of the lease. The alarming change here is incorporating a lease (of software/hardware controlled functionality) into the actual purchase of a car. See: John Deere & tractors, Right to Repair, etc.
- ta988 5y agoLeasing where you paid the full price upfront anyway and is still charged the regular fees.
- asplake 5y agoThe ultimate subscription would be to the kind of car I need right now, just in time
- ric2b 5y agoI think a subscription would be different in that you'd be able to easily switch to a different car on demand, for example if you needed a truck/van to carry some stuff. And possibly work like electric scooters, you just park the car and it's not your problem, the next day you use a different one that's close by.
- 5y ago
- alphachloride 5y agoIt is interesting how I am unable to find one single link whatsoever on that webpage which goes to wd.com, instead of community.wd.com, including the hyperlinked logo of wd, to discover what actually wd is.
- Santosh83 5y agoWhy should the industry accept as inevitable, even push forward aggressively, on the paradigm that every single device (even non computing ones) should be network connected 24x7? Are we always mind-connected to every other human? Wouldn't that open us to all sorts of hacking? I think the s/w and IoT industry needs to step back and consider if they aren't inventing problems rather than solving them.
- lostlogin 5y agoSome of it is beyond strange too. Even self hosted things break. The Unifi Dream Machine Pro or Plex seem to insist on a WAN connection to their home and break without it.
- Syonyk 5y agoBecause that's apparently the "solution" to the existential horror that someone might buy something, pay money once, and then use it for a long time and maybe even fix it if it breaks. Instead, of course, the desired end state is that nobody ever buys anything, but is always on the hook for endless "rental" and "subscription" fees. More profitable that way for the companies producing the crap. Unfortunately, they also believe (rightly or wrongly, I don't know, I'm not the target market here) that unless things have an App(TM) to go with it, nobody will buy it. Why would you buy a "dumb toaster" when you can buy an app-enabled "smart toaster" with firmware updates and the ability to send your phone a notification when your toast is done? Standing in the kitchen listening for the ding is soooooo old fashioned! And, the reality is that most of the companies pushing stuff like that are also "data extraction" companies. There are other companies that pay what, apparently, is reasonably large sums of money for "big data elements" about people. How often do you make toast? Do you like your toast light or dark? What sort of bread do you like? What time do you eat breakfast? Do you sleep in on weekends and make toast later? Do you like eggs on your toast? Do you eat it in a box? Do you eat it with a fox? Do you eat it here or there? Will you make toast anywhere? Why this is so valuable, I've no idea, but I certainly want no part of this ecosystem. I've been considering a streaming stick of some sort to replace what appears to be a dying NUC, and some of the "privacy" policies are utterly absurd. Roku's is the worst. It roughly amounts to, "Anything we can think of, we will do and upload, to include scanning your network to find out what else you use. Once we have the data, we will do anything we want with it. And if the laws of your country would make that a problem, we'll just move it to another country that doesn't care and use it there." Really quite horrifying to read. But they're absolutely inventing new problems - that your device is suddenly without firmware updates and "Oh No, Security Issues!" The solution is, of course, for you to buy another one to replace what would be a perfectly functional one, but they got bored, and updates are hard, and... seriously, who uses a hard drive more than like... 2 years, anyway? Over the years, I've been increasingly spending my free time away from the internet, working with what seems to be a trend towards older and older machinery. Motorcycles from the early 2000s (some based on late 1930s designs with fairly little evolution since then), a tractor from the early 40s, a car from 1930, etc. And it's a nice breath of fresh air (well, and usually a bit of gas vapors...) compared to the modern stuff. They were built to be maintained, repaired, and have no bloody firmware in them. It's a nice direction.
- ivraatiems 5y agoI posted this in the other thread on this topic, but the CVE for this issue - https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/CVE-2018-18472 - has been public since 2019. No action taken by WD to remedy it, by their own admission (I found this link on their own announcement). That's seriously messed up. I'd have to very seriously second-guess buying anything that involves software of any kind from this company.
- brailsafe 5y agooof
- SilverRed 5y agoThis should really trigger some kind of mass recall like what is done for cars when there is a safety issue. WD should be obligated to try to make contact with every user of the product to refund them.
- zelon88 5y agoI understand the sentiment, but the reality of the situation is if your WD device is hacked while on your home LAN network, you have a much bigger security problem than where your data isn't.
- blincoln 5y agoI don't use this specific WD product, but I've had some other network devices automatically and silently add port-forwarding rules to my router using uPnP, even though I never planned to access them from the internet. Maybe that's what happened here?
- Santosh83 5y agoDumb hard disks are still fine I'd guess. Just don't go for any "smart", connected or networked device. I have several plain backup HDDs from WD and they, IME, have been more reliable than Seagate from a hardware point of view.
- dandongus 5y agoHonestly, anyone who didn't see this coming when they purchased an 'internet-connected hard drive' deserves it.
- Exuma 5y agoNo one deserves to have their data erased, my mum wouldn't know the difference.
- dang 5y agoOther related thread: WD My Book users wake up to find their data deleted - https://news.ycombinator.com/item?id=27624735 https://news.ycombinator.com/item?id=27624735 - June 2021 (254 comments)
- interestica 5y agoSeagate EOL'd its "GoFlex" series of drives (NAS and external cases) a couple years ago. The right thing to do would have been to open it up (they're running linux) so that people could make better use of them instead of essentially turning them into semi-crippled garbage. Someone's dedicated blog gave a bit more usability for a while (such as the necessary hacks to actually make the drives compatible with their own system!) - http://goflexhome.blogspot.com/p/ive-had-my-goflex-home-for-around-5.html http://goflexhome.blogspot.com/p/ive-had-my-goflex-home-for-.... Yeah - they sold interchangeable drives/docks that wouldn't actually work interchangeably until you issued your own fixes. They had a stupid server-based auth system that they obviously didn't want to keep maintaining. But, that auth system wasn't even necessary except for utilizing their webclient. It's a shame, because the NAS/DLNA drive was fast and reliable on a home network.