17 ms·

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" an

According to Western Digital[1], the CVE involved[2] has been public and unpatched since 2019. That's insane. There's "we don't support end-of-life devices" and then there's "we refuse to fix absolutely critical, crippling security vulnerabilities in devices just a few years old." This is well over the line. I smell (but have no idea of the merits of) a class action lawsuit. [1] https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo https://www.westerndigital.com/support/productsecurity/wdc-2... [2] https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/CVE-2018-18472

gertrunde 5y ago
From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.
- busymom0 5y ago
  I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.
  - zamadatix 5y ago
    There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse. You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early. You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all). You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways. . Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.
    - andi999 5y ago
      EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.
      - Algent 5y ago
        With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.
        andi999 5y ago
        You have a Citation? I read 5-7 years.
        bellyfullofbac 5y ago
        Pixel XL released October 2016 (from [1]), no guaranteed updates after October 2018 [2]. I looked at the Pixel 4, released October 2019, discontinued October 2020, no guaranteed updates after October 2022... [1] https://www.gsmarena.com/google_pixel_xl-8345.php https://www.gsmarena.com/google_pixel_xl-8345.php [2] https://support.google.com/nexus/answer/4457705?hl=en#zippy=,pixel-phones https://support.google.com/nexus/answer/4457705?hl=en#zippy=...
        andi999 5y ago
        That is not at best, probably this is at worst. But thanks for the info.
        LeonidasXIV 5y ago
        In Android-land this is currently about the best actually. There is a chance of it improving over time as the updates will be decoupled from hardware support but the situation is markedly worse than on iOS.
- bonzini 5y ago
  Despite being end-of-support in 2018, the device received its final firmware update in 2015 according to https://community.wd.com/t/action-required-on-my-book-live-and-my-book-live-duo/268147 https://community.wd.com/t/action-required-on-my-book-live-a.... Four-year support for a device that is connected to the Internet is ridiculous. I bought a Synology device in late 2012 and it's still getting major release updates.
- black_puppydog 5y ago
  That's three years for a device that is presented as an archival thing that you put in our broom cupboard and forget about. That is insanely short.
ChuckMcM 5y ago
Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to affirmatively indicate that you know it is no longer supported and any further use comes at your own risk. It is also another great case study for open source NAS devices, like the TrueNAS line, that you can patch even if iXSystems goes away.
- freeone3000 5y ago
  I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.
  - throwawayboise 5y ago
    12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.
    - lrem 5y ago
      As they should. A drive failing after 12 years is a successful outcome that only 50% of drives reach.
      - mnw21cam 5y ago
        Yes, but there's a difference between the expected rate of mechanical failure, and the existence of a software bug. The current fault erases everything on the drive. That can be equated fairly equally with mechanical failure. Let's imagine a different bug for instance, that allows anyone on the internet to read/write all the data on the drive. If one of these bugs emerged after 12 years, then there is a much stronger argument that the manufacturer should fix it, because it is a fundamental fault with the device. Under the sale of goods act of 1979, the device must be suitable for the purpose for which it was sold, and there is no time limit on that, so any consumer with the device could demand that the person who sold it to them fix it. The device was unsuitable for the purpose for which it was sold from day one - it just took 12 years to find that out.
tamlin 5y ago
Typically when building a device like this you get a version of Linux / embedded-OS from the SoC vendor and you are stuck with it because SoC vendor doesn't provide docs that would allow drivers to be maintained. This makes ongoing support harder than it might otherwise be.
- deleted 5y ago
  [deleted]
- ec109685 5y ago
  This is a poor call for a network appliance, especially given it can be connected to from the internet.
- johannes1234321 5y ago
  When taking in third party dependencies you take over responsibility. If I build a machine and the third-party screws I use break my customers come to me. If I use bad quality npm modules as dependencies it's my bad. If I use an embedded system with flaws it's my issue.
ineedasername 5y ago
From the CVE, the Overall CVSS Score was only 9.8 That means they were still 0.2 away from the worst possible vulnerability score. So, on the one hand, Could be worse! On the other hand, there could be a software dev sitting out there thinking "I screwed up big time & didn't even get a perfect score on it. Oh well, better luck next time."
- ric2b 5y ago
  I guess it's not a 10 because it couldn't cause a fire or explosion? You can't just expect to get a perfect score by accident, you need to work for it.
msravi 5y ago
From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?
- slim 5y ago
  Either it's advertised through mdns or you add "panel" to your hosts file with the right ip
- jbverschoor 5y ago
  I’m sorry but this is just incompetence by them. No sophisticated exploit. Just naive lazy pre-junior dev work
  - jbverschoor 5y ago
    Not sure why I'm being downvoted. Maybe by some other incompetent devs/pms
    - jbverschoor 5y ago
      Give me some more of that -4 bastards. I still have 3K+
- Erwin 5y ago
  curl has a handy --resolve option for telling it how to resolve certain names. Useful when you want to connect to something that thinks it's foo.bar.com and send the right tls/host, but DNS doesn't have it correct yet
- chtitux 5y ago
  curl has a very handy --resolve option for that: curl --resolve 'panel:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration Hostname can be set to * in recent versions of curl, it's even more handy: curl --resolve '*:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration
tlavoie 5y ago
I have one, and looked into what I might put on it instead of the unsupported software some years ago. I had noticed shortly after purchase that it was basically a Debian install, on MIPS if I recall correctly. While WD had essentially washed their hands of the device ages previous, it wasn't going to have a current Linux to put on either. Maybe one of the BSDs could be an option. Instead of worrying too much about it, I have the remote access feature turned off, and have other backup options in case this goes belly up. I will be looking closely at what vulns come to light as being exploited though.
- sam_lowry_ 5y ago
  I had WD MyBook World and WD MyBook Live devices for many years as cheap cold storage. Replaced the last one earlier this year by an Olimex Storage Box [1] and a Seagate 2,5" 4TB ST4000LM016 drive. But even when I operated them, I disabled all the cloud features. These were Debian boxes, you could ssh in, enable NFS, stop all WD proprietary software and live happily every after. Newer WD NAS devices are much harder to tweak, none should buy them anyway. [1] https://www.olimex.com/Products/OLinuXino/BOXES/BOX-MICRO-B/ https://www.olimex.com/Products/OLinuXino/BOXES/BOX-MICRO-B/
  - tlavoie 5y ago
    Even as Debian boxes, they're limited because Debian isn't supporting the platform any more either. That means you can't just point it to a new repo, and do all the usual apt goodness to get an up to date system. I'm leaning toward one of these as a basic NAS replacement: https://ameridroid.com/collections/single-board-computer/products/odroid-hc2 https://ameridroid.com/collections/single-board-computer/pro... Based on the Odroid XU4, it's a fairly speedy little SBC that runs Armbian, and has a heat sink that doubles as mounting for your hard drive of choice.
deleted 5y ago
[deleted]
Popegaf 5y ago
EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it's also about the environment. Forcing things to become dangerous for use or just having the power to kill it remotely out of business interests means more electronic trash. https://publiccode.eu/ https://publiccode.eu/ goes in the right direction on a similar topic, but this should also start getting a bit of the limelight.
- rbanffy 5y ago
  This is an interesting point: there is an analogy to be made with unmaintained equipment that can become environmental hazards and making such equipment without proper warnings and recalls. I was thinking of getting one for myself, but I think I'll stick to USB-connected JBODs.
  - greyhair 5y ago
    I live the hybrid life, connected media, with the essential data backed up to disconnected USB drives. Convenience and resilience at the same time. Also, you need at least two different USB drives, that you back up to in A/B fashion. I prefer to own two separate brands.
- megous 5y ago
  The powerpc SoC in that drive is even supported in mainline Linux. And the code for original v2.6.32 Linux and some ancient U-Boot is available on WD website. So people could have made their drives secure after EOL. Some maybe even did.
  - dividedbyzero 5y ago
    > So people could have made their drives secure after EOL. A very, very, very select few with the necessary skills could have. This is a mass-market device, if 1 in 10 000 buyers is able to do this, that'd be a lot, and then those would have a Linux machine on an ancient SoC with none of the original functionality.
DonHopkins 5y ago
The box should prominently display how many years of life you're buying, in the same giant font size that it shows how many terabytes of storage you're buying.
- deleted 5y ago
  [deleted]
hawski 5y ago
I also hate how when your phone or other device (i.e. I have an old Chromebook) is no longer supported there is no indication whatsoever that it is the case. You have to surf around the web to find EOL dates and every producer has it different. It should be visible and more in your face or at the very least it should be in "About" or Update settings.
CoolGuySteve 5y ago
A lawsuit is one thing but I’m hoping for a congressional inquiry and better consumer protection laws. Imagine how many people are walking around right now with Android phones that are more than 2 years old and no longer receiving updates. It’s such a sizable portion of the population that at some point an attack like this on Android will become a national security and economic issue.
caymanjim 5y ago
> I smell (but have no idea of the merits of) a class action lawsuit. Class action lawsuits don't seem to help anyone except lawyers. I'm not being cynical; they really seem to benefit only lawyers. I've gotten caught up in plenty of class action payouts over things like this, and invariably I lose more on the time wasted reading the letter or email about it than I gain from being part of the class. Things like checks for $1.90 or a month of "free" service from something I haven't used in years. I want companies to be punished for egregious failures (not sure this one qualifies), but I'd honestly rather have the money go 100% to the government and be used to fund more enforcement and prosecutions. It's adding insult to injury when they make token reimbursements to us peasants.

gertrunde 5y ago

From what I can find, this particular device was launched around 2011, and went end of support pre-2016. (Although potentially something that in hindsight WD would have wanted to patch anyway - assuming end users patch things). And maybe highlights that support lifecycles for IoT devices should be longer. Correction: End-of-Support appears to be last manufacture date (2015) + 3 years, so assuming 2018.

busymom0 5y ago
I wonder if the bad publicity which will come out of this was worth it for them. Fixing such a crucial bug would have probably taken a few hours of work.
- zamadatix 5y ago
  There's really no winning with this. You can release patches 6 years after your device is EoL but there will forever be more security issues and people using your ancient product (think how long it takes some versions of Windows to truly reach less than 100k active machines. Hell I wonder if Windows 3.1 has really reached that number or not. The long tail is going to be loooong). Not to mention you've created a precedent that the device is still getting patches and can be used by users, only making the lifecycle issue worse. You can release a version which severely limits the capability of the product or effectively disables it but this is just a guaranteed way of getting bad press and even more customers will be mad at you for killing a device early. You can turn the device over to the community (if you can managed to get it through legal and 3rd party agreements) but that isn't actually going to solve anything as it's not a product for extremely tech savvy users, at best it buys deflection in the news report in exchange for the effort of doing this (if you can at all). You can claim the lifecycle is over and years later and be technically correct but still get the bad press and user feedback anyways. . Retrospective in this particular case it would have been really great for them to fix this particular issue but that's an extremely hard thing to accurately judge unless you're from the future. I mean what percentage of devices that are many years EoL you've heard get this bad of a publicity hit? I'm sure there are many individual cases to point to but it's nothing against the absolute deluge of devices that have been discontinued over the years quietly without issue.
  - andi999 5y ago
    EOL is 3 years after purchase (if bought in 2015)? Just imagine a car and after 3 years no more spare parts? Personally everything below 10 years sounds ridiculous to me.
    - Algent 5y ago
      With modern high end smartphone it's the same issue. At best you get 2 years of patchs now, which is ridiculous because they really expect people to be able to afford >700€ phones that often.
      - andi999 5y ago
        You have a Citation? I read 5-7 years.
        bellyfullofbac 5y ago
        Pixel XL released October 2016 (from [1]), no guaranteed updates after October 2018 [2]. I looked at the Pixel 4, released October 2019, discontinued October 2020, no guaranteed updates after October 2022... [1] https://www.gsmarena.com/google_pixel_xl-8345.php https://www.gsmarena.com/google_pixel_xl-8345.php [2] https://support.google.com/nexus/answer/4457705?hl=en#zippy=,pixel-phones https://support.google.com/nexus/answer/4457705?hl=en#zippy=...
        andi999 5y ago
        That is not at best, probably this is at worst. But thanks for the info.
        LeonidasXIV 5y ago
        In Android-land this is currently about the best actually. There is a chance of it improving over time as the updates will be decoupled from hardware support but the situation is markedly worse than on iOS.
bonzini 5y ago
Despite being end-of-support in 2018, the device received its final firmware update in 2015 according to https://community.wd.com/t/action-required-on-my-book-live-and-my-book-live-duo/268147 https://community.wd.com/t/action-required-on-my-book-live-a.... Four-year support for a device that is connected to the Internet is ridiculous. I bought a Synology device in late 2012 and it's still getting major release updates.
black_puppydog 5y ago
That's three years for a device that is presented as an archival thing that you put in our broom cupboard and forget about. That is insanely short.

ChuckMcM 5y ago

Wow. This is the ultimate IoT failure scenario, the product is in use but no longer supported and an exploit can hit it from the Internet. I suspect there will be litigation, but I am not a lawyer. I will be interested to see it though, what is the responsibility for using things post end-of-life? What we might see is a new “your on your own” mode built into this sort of appliance that once EOL hits it asks you to affirmatively indicate that you know it is no longer supported and any further use comes at your own risk. It is also another great case study for open source NAS devices, like the TrueNAS line, that you can patch even if iXSystems goes away.

freeone3000 5y ago
I think the issue here is "end of life" is defined way too soon for portable hard drives. The mechanical parts have a 4% annual failure rate, or a half-life of 12.5 years. The software should be supported for that long.
- throwawayboise 5y ago
  12 years? Typical business life of a computer is 5 years. Typical service/support agreement is 1-3 years. Try getting Apple to address a failed hard drive that's 12 years old. They'd laugh in your face.
  - lrem 5y ago
    As they should. A drive failing after 12 years is a successful outcome that only 50% of drives reach.
    - mnw21cam 5y ago
      Yes, but there's a difference between the expected rate of mechanical failure, and the existence of a software bug. The current fault erases everything on the drive. That can be equated fairly equally with mechanical failure. Let's imagine a different bug for instance, that allows anyone on the internet to read/write all the data on the drive. If one of these bugs emerged after 12 years, then there is a much stronger argument that the manufacturer should fix it, because it is a fundamental fault with the device. Under the sale of goods act of 1979, the device must be suitable for the purpose for which it was sold, and there is no time limit on that, so any consumer with the device could demand that the person who sold it to them fix it. The device was unsuitable for the purpose for which it was sold from day one - it just took 12 years to find that out.

tamlin 5y ago

Typically when building a device like this you get a version of Linux / embedded-OS from the SoC vendor and you are stuck with it because SoC vendor doesn't provide docs that would allow drivers to be maintained. This makes ongoing support harder than it might otherwise be.

deleted 5y ago
[deleted]
ec109685 5y ago
This is a poor call for a network appliance, especially given it can be connected to from the internet.
johannes1234321 5y ago
When taking in third party dependencies you take over responsibility. If I build a machine and the third-party screws I use break my customers come to me. If I use bad quality npm modules as dependencies it's my bad. If I use an embedded system with flaws it's my issue.

ineedasername 5y ago

From the CVE, the Overall CVSS Score was only 9.8 That means they were still 0.2 away from the worst possible vulnerability score. So, on the one hand, Could be worse! On the other hand, there could be a software dev sitting out there thinking "I screwed up big time & didn't even get a perfect score on it. Oh well, better luck next time."

ric2b 5y ago
I guess it's not a 10 because it couldn't cause a fire or explosion? You can't just expect to get a perfect score by accident, you need to work for it.

msravi 5y ago

From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration https:///panel/rest/configuration How does one get to resolve /panel/rest/configuration?

slim 5y ago
Either it's advertised through mdns or you add "panel" to your hosts file with the right ip
jbverschoor 5y ago
I’m sorry but this is just incompetence by them. No sophisticated exploit. Just naive lazy pre-junior dev work
- jbverschoor 5y ago
  Not sure why I'm being downvoted. Maybe by some other incompetent devs/pms
  - jbverschoor 5y ago
    Give me some more of that -4 bastards. I still have 3K+
Erwin 5y ago
curl has a handy --resolve option for telling it how to resolve certain names. Useful when you want to connect to something that thinks it's foo.bar.com and send the right tls/host, but DNS doesn't have it correct yet
chtitux 5y ago
curl has a very handy --resolve option for that: curl --resolve 'panel:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration Hostname can be set to * in recent versions of curl, it's even more handy: curl --resolve '*:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration

tlavoie 5y ago

I have one, and looked into what I might put on it instead of the unsupported software some years ago. I had noticed shortly after purchase that it was basically a Debian install, on MIPS if I recall correctly. While WD had essentially washed their hands of the device ages previous, it wasn't going to have a current Linux to put on either. Maybe one of the BSDs could be an option. Instead of worrying too much about it, I have the remote access feature turned off, and have other backup options in case this goes belly up. I will be looking closely at what vulns come to light as being exploited though.

sam_lowry_ 5y ago
I had WD MyBook World and WD MyBook Live devices for many years as cheap cold storage. Replaced the last one earlier this year by an Olimex Storage Box [1] and a Seagate 2,5" 4TB ST4000LM016 drive. But even when I operated them, I disabled all the cloud features. These were Debian boxes, you could ssh in, enable NFS, stop all WD proprietary software and live happily every after. Newer WD NAS devices are much harder to tweak, none should buy them anyway. [1] https://www.olimex.com/Products/OLinuXino/BOXES/BOX-MICRO-B/ https://www.olimex.com/Products/OLinuXino/BOXES/BOX-MICRO-B/
- tlavoie 5y ago
  Even as Debian boxes, they're limited because Debian isn't supporting the platform any more either. That means you can't just point it to a new repo, and do all the usual apt goodness to get an up to date system. I'm leaning toward one of these as a basic NAS replacement: https://ameridroid.com/collections/single-board-computer/products/odroid-hc2 https://ameridroid.com/collections/single-board-computer/pro... Based on the Odroid XU4, it's a fairly speedy little SBC that runs Armbian, and has a heat sink that doubles as mounting for your hard drive of choice.

deleted 5y ago

[deleted]

Popegaf 5y ago

EOL should be made to legally mean: opensource or something equivalent. If Windows isn't supported on my laptop, I can nearly always replace it with Linux and still keep it alive. With stuff like this, they can decide to never update it again or just turn off some critical service and render a device unusable. It's not just a thing about owning what you purchase and having the freedom to do what you want with it, it's also about the environment. Forcing things to become dangerous for use or just having the power to kill it remotely out of business interests means more electronic trash. https://publiccode.eu/ https://publiccode.eu/ goes in the right direction on a similar topic, but this should also start getting a bit of the limelight.

rbanffy 5y ago
This is an interesting point: there is an analogy to be made with unmaintained equipment that can become environmental hazards and making such equipment without proper warnings and recalls. I was thinking of getting one for myself, but I think I'll stick to USB-connected JBODs.
- greyhair 5y ago
  I live the hybrid life, connected media, with the essential data backed up to disconnected USB drives. Convenience and resilience at the same time. Also, you need at least two different USB drives, that you back up to in A/B fashion. I prefer to own two separate brands.
megous 5y ago
The powerpc SoC in that drive is even supported in mainline Linux. And the code for original v2.6.32 Linux and some ancient U-Boot is available on WD website. So people could have made their drives secure after EOL. Some maybe even did.
- dividedbyzero 5y ago
  > So people could have made their drives secure after EOL. A very, very, very select few with the necessary skills could have. This is a mass-market device, if 1 in 10 000 buyers is able to do this, that'd be a lot, and then those would have a Linux machine on an ancient SoC with none of the original functionality.

DonHopkins 5y ago

The box should prominently display how many years of life you're buying, in the same giant font size that it shows how many terabytes of storage you're buying.

deleted 5y ago
[deleted]

hawski 5y ago

I also hate how when your phone or other device (i.e. I have an old Chromebook) is no longer supported there is no indication whatsoever that it is the case. You have to surf around the web to find EOL dates and every producer has it different. It should be visible and more in your face or at the very least it should be in "About" or Update settings.

CoolGuySteve 5y ago

A lawsuit is one thing but I’m hoping for a congressional inquiry and better consumer protection laws. Imagine how many people are walking around right now with Android phones that are more than 2 years old and no longer receiving updates. It’s such a sizable portion of the population that at some point an attack like this on Android will become a national security and economic issue.

caymanjim 5y ago

> I smell (but have no idea of the merits of) a class action lawsuit. Class action lawsuits don't seem to help anyone except lawyers. I'm not being cynical; they really seem to benefit only lawyers. I've gotten caught up in plenty of class action payouts over things like this, and invariably I lose more on the time wasted reading the letter or email about it than I gain from being part of the class. Things like checks for $1.90 or a month of "free" service from something I haven't used in years. I want companies to be punished for egregious failures (not sure this one qualifies), but I'd honestly rather have the money go 100% to the government and be used to fund more enforcement and prosecutions. It's adding insult to injury when they make token reimbursements to us peasants.