4 ms·

"The My Book Live device received its final firmware update in 2015." A unpatched in 6 years linux device directly connected to the internet? What could possib

"The My Book Live device received its final firmware update in 2015." A unpatched in 6 years linux device directly connected to the internet? What could possibly go wrong? "There is no IoT, there is only the internet of unpatched linux boxes."

nhoughto 5y ago
doesn't appear to be a directly connected to the internet problem, even NAT'd stuff wiped data.
- dcow 5y ago
  That's not how C2 servers work. Connected to the internet means connected to the internet.
- martyvis 5y ago
  By definition "directly connected to the internet" means if a device can on its on accord, direct requests to an entity, ask it a question, and act upon it is true. From what I understand these WD boxes go to a management service in the cloud. and were told they should factory reset. Whether something is pull-only (as in this case) or push (say allows HTTP or SSH access from a random on the internet) is irrelavnt if either result in unauthorised activity on a box in your home.
  - haswell 5y ago
    In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall. For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”
    - bigiain 5y ago
      How good do you reckon a 6 years past EOL consumer linux device's defences against a browser running 3rd (or 1st) party javascript making http requests to http://192.168.0.1..254]/cgi-bin/factoryRestore.sh http://192.168.0.1..254]/cgi-bin/factoryRestore.sh? How much would you bet against that being an unauthenticated call or one with leaked hard coded reds?
      - biglost 5y ago
        My Firefox on ios crash with that link
        bigiain 5y ago
        That's kinda surprising it "crashes", but it's also kinda meta code... (and either i typed it or HN's formatter munged it...) Assume some javascript that loops through: http://192.168.0.1/cgi-bin/factoryRestore.sh http://192.168.0.1/cgi-bin/factoryRestore.sh http://192.168.0.2/cgi-bin/factoryRestore.sh http://192.168.0.2/cgi-bin/factoryRestore.sh http://192.168.0.3/cgi-bin/factoryRestore.sh http://192.168.0.3/cgi-bin/factoryRestore.sh up to http://192.168.0.254/cgi-bin/factoryRestore.sh http://192.168.0.254/cgi-bin/factoryRestore.sh Those just give connection errors for me, but: http://192.168.1.1/cgi/ACT_FACTORY_RESET http://192.168.1.1/cgi/ACT_FACTORY_RESET gives me a 403 Forbidden error, and if there was a known default password to my router - it'd try and do a factory reset on it. (It actually wouldn't, it'd send back a confirmation popup, but...)
      - fouc 5y ago
        Not sure this makes any sense, the 6 years past EOL consumer linux device isn't running a browser. Or are you assuming the user's browser itself is compromised and is running random javascript hitting the NAS address? That would be unfortunate, but I'm not sure I'd blame it on the "6 years past EOL consumer linux device"
        bigiain 5y ago
        Doesn’t need any browser compromise as such, just a user on the same wifi network running a browser and visiting a site with malicious JavaScript (possible a malicious site, possible a benign site with us delivered by a shitty ad network, possible a poorly secured site with persistent xss flaws). Classic old cross origin request forgery. It ranks #7 I owasp’s top 10 website security flaws, and they have this to say about it: “XSS is the second most prevalent issue in the OWASP Top 10, and is found in around two thirds of all applications.“
    - nhoughto 5y ago
      Yeah difference in threat model of “evil internet can make tcp connection to me” vs “basically need a c2 compromise” is huge. Sucks for those that lost data either way.
- ineedasername 5y ago
  How did that work unless there was port forwarding?
boardwaalk 5y ago
This doesn't appear to have anything directly to do with Linux, just crappy software written by WD running on it. Please be a little more careful with your criticism.
- Legion 5y ago
  I don’t think the commenter was criticizing Linux. Seemed more a comment on the manufacturers who lazily slap these products together with minimal effort. Taking a free OS, sprinkling a thin layer of their software on top, and then abandoning their responsibility to maintain the full software stack being a common example of that minimal effort. So, yes, essentially you end up with a bunch of devices running vendor-specific unmaintained Linux distros on the wide open Internet. The “unmaintained” part of that sentence is the problem, not the “Linux” part.
  - akie 5y ago
    I agree, but it also makes me consider what the role of software engineering (as a discipline) is in this disaster. Shouldn't we design systems that are hard to break by default? Shouldn't the OS assume that terrible things are going to happen anyway, and provide protection from bad faith actors in case the OS is indeed left unpatched for 10 years while being fully exposed to the internet? Is it even possible to design a system that provides this level of security so that we can get away with near-zero additional security expertise from product designers who build on top of it? I think that, first of all, it's Western Digital's responsibility that things went south here. But shouldn't we build systems that provide bomb-proof security for the many companies that build on top of it? Is it even possible? And if so, how? In the end we would be doing ourselves (as consumers) a favor.
    - megous 5y ago
      Current mainline Linux still has support for the powerpc SoC in those drives. It may take a week for someone to prepare alternative firmware for the device, that is modern, uptodate and safer. U-Boot dropped the support in 2017. So if anyone wants to support their 11 year old drive they can do so.

nhoughto 5y ago

doesn't appear to be a directly connected to the internet problem, even NAT'd stuff wiped data.

dcow 5y ago
That's not how C2 servers work. Connected to the internet means connected to the internet.
martyvis 5y ago
By definition "directly connected to the internet" means if a device can on its on accord, direct requests to an entity, ask it a question, and act upon it is true. From what I understand these WD boxes go to a management service in the cloud. and were told they should factory reset. Whether something is pull-only (as in this case) or push (say allows HTTP or SSH access from a random on the internet) is irrelavnt if either result in unauthorised activity on a box in your home.
- haswell 5y ago
  In defense of the parent comment, there is a meaningful difference between a device acting as the terminating IP meaning any open services are directly probe-able and a device sitting behind a firewall. For this particular attack (assuming c2 server compromise?) that might not matter, but ultimately there is a massive difference in attack surface when comparing “direct” with “NATed”
  - bigiain 5y ago
    How good do you reckon a 6 years past EOL consumer linux device's defences against a browser running 3rd (or 1st) party javascript making http requests to http://192.168.0.1..254]/cgi-bin/factoryRestore.sh http://192.168.0.1..254]/cgi-bin/factoryRestore.sh? How much would you bet against that being an unauthenticated call or one with leaked hard coded reds?
    - biglost 5y ago
      My Firefox on ios crash with that link
      - bigiain 5y ago
        That's kinda surprising it "crashes", but it's also kinda meta code... (and either i typed it or HN's formatter munged it...) Assume some javascript that loops through: http://192.168.0.1/cgi-bin/factoryRestore.sh http://192.168.0.1/cgi-bin/factoryRestore.sh http://192.168.0.2/cgi-bin/factoryRestore.sh http://192.168.0.2/cgi-bin/factoryRestore.sh http://192.168.0.3/cgi-bin/factoryRestore.sh http://192.168.0.3/cgi-bin/factoryRestore.sh up to http://192.168.0.254/cgi-bin/factoryRestore.sh http://192.168.0.254/cgi-bin/factoryRestore.sh Those just give connection errors for me, but: http://192.168.1.1/cgi/ACT_FACTORY_RESET http://192.168.1.1/cgi/ACT_FACTORY_RESET gives me a 403 Forbidden error, and if there was a known default password to my router - it'd try and do a factory reset on it. (It actually wouldn't, it'd send back a confirmation popup, but...)
    - fouc 5y ago
      Not sure this makes any sense, the 6 years past EOL consumer linux device isn't running a browser. Or are you assuming the user's browser itself is compromised and is running random javascript hitting the NAS address? That would be unfortunate, but I'm not sure I'd blame it on the "6 years past EOL consumer linux device"
      - bigiain 5y ago
        Doesn’t need any browser compromise as such, just a user on the same wifi network running a browser and visiting a site with malicious JavaScript (possible a malicious site, possible a benign site with us delivered by a shitty ad network, possible a poorly secured site with persistent xss flaws). Classic old cross origin request forgery. It ranks #7 I owasp’s top 10 website security flaws, and they have this to say about it: “XSS is the second most prevalent issue in the OWASP Top 10, and is found in around two thirds of all applications.“
  - nhoughto 5y ago
    Yeah difference in threat model of “evil internet can make tcp connection to me” vs “basically need a c2 compromise” is huge. Sucks for those that lost data either way.
ineedasername 5y ago
How did that work unless there was port forwarding?

boardwaalk 5y ago

This doesn't appear to have anything directly to do with Linux, just crappy software written by WD running on it. Please be a little more careful with your criticism.

Legion 5y ago
I don’t think the commenter was criticizing Linux. Seemed more a comment on the manufacturers who lazily slap these products together with minimal effort. Taking a free OS, sprinkling a thin layer of their software on top, and then abandoning their responsibility to maintain the full software stack being a common example of that minimal effort. So, yes, essentially you end up with a bunch of devices running vendor-specific unmaintained Linux distros on the wide open Internet. The “unmaintained” part of that sentence is the problem, not the “Linux” part.
- akie 5y ago
  I agree, but it also makes me consider what the role of software engineering (as a discipline) is in this disaster. Shouldn't we design systems that are hard to break by default? Shouldn't the OS assume that terrible things are going to happen anyway, and provide protection from bad faith actors in case the OS is indeed left unpatched for 10 years while being fully exposed to the internet? Is it even possible to design a system that provides this level of security so that we can get away with near-zero additional security expertise from product designers who build on top of it? I think that, first of all, it's Western Digital's responsibility that things went south here. But shouldn't we build systems that provide bomb-proof security for the many companies that build on top of it? Is it even possible? And if so, how? In the end we would be doing ourselves (as consumers) a favor.
  - megous 5y ago
    Current mainline Linux still has support for the powerpc SoC in those drives. It may take a week for someone to prepare alternative firmware for the device, that is modern, uptodate and safer. U-Boot dropped the support in 2017. So if anyone wants to support their 11 year old drive they can do so.