6 ms·

I posted this in the other thread on this topic, but the CVE for this issue - https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/C

I posted this in the other thread on this topic, but the CVE for this issue - https://nvd.nist.gov/vuln/detail/CVE-2018-18472 https://nvd.nist.gov/vuln/detail/CVE-2018-18472 - has been public since 2019. No action taken by WD to remedy it, by their own admission (I found this link on their own announcement). That's seriously messed up. I'd have to very seriously second-guess buying anything that involves software of any kind from this company.

brailsafe 5y ago
oof
SilverRed 5y ago
This should really trigger some kind of mass recall like what is done for cars when there is a safety issue. WD should be obligated to try to make contact with every user of the product to refund them.
- zelon88 5y ago
  I understand the sentiment, but the reality of the situation is if your WD device is hacked while on your home LAN network, you have a much bigger security problem than where your data isn't.
  - blincoln 5y ago
    I don't use this specific WD product, but I've had some other network devices automatically and silently add port-forwarding rules to my router using uPnP, even though I never planned to access them from the internet. Maybe that's what happened here?
Santosh83 5y ago
Dumb hard disks are still fine I'd guess. Just don't go for any "smart", connected or networked device. I have several plain backup HDDs from WD and they, IME, have been more reliable than Seagate from a hardware point of view.
- dividedbyzero 5y ago
  USB HDDs are definitely not a replacement for a lot of NAS use cases.
  - noxer 5y ago
    And a NAS is not a replacement for a backup.
bjt2n3904 5y ago
So it's got to be publicly accessable? A NAT'd device can't get hit from the outside?
- Scoundreller 5y ago
  Doesn’t seem to be what’s happened here. These WD devices were phoning home on scheduled intervals and it appears that got issued a factory-reset command, but only at the “quick” format level so everything might still be there but will need to go through a recovery procedure.
  - SOMA_BOFH 5y ago
    they should stop phoning home if the device is end of life.
  - londons_explore 5y ago
    I would take a guess this is not a 'hacker', but instead some mistake by a WD employee who was changing serverside software/config. Maybe even a disgruntled employee trying to wreak havoc...
ksml 5y ago
The WD response to the original bug report (from https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/): > The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012. These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle. So support can be discontinued after two years after introducing a product??? That's ridiculous. It's not even like this was a one-off product and they're no longer supporting that line of work. WD still sells MyBooks.
- gogopuppygogo 5y ago
  Support can be ended at any time and leave you hanging when relying on proprietary software. The fallout from this will be worse for western digitals brand than just patching the cloud service or smartly shutting it off if they weren’t going to support it.
  - makeitdouble 5y ago
    If they sold it in the EU I think legally they have at least 2 years of support to do. Assuming the software not working directly affects the devices sold abilities.
    - qwertox 5y ago
      I don't think so. The seller (not the manufacturer) has to make sure that the device is free of faults for up to two years. The first 6 months it's up to the seller to prove that the device had no issues in the first place, afterwards it it up to the buyer to prove that the device was faulty to begin with. The manufacturer can only provide a warranty and exclude a lot from it. Like Motorola does with the batteries of the smartphones, which only have 3 months of warranty. The seller has to cover the 2 years. There is no obligation to support a device, like to provide firmware to fix bugs. If the hardware/firmware has a bug, it is a defect, which entitles you to a fault-free replacement within 2 years.
      - 5y ago
xroche 5y ago
> That's seriously messed up. I'd have to very seriously second-guess buying anything that involves software of any kind from this company. If you connect a device to the Internet, you must maintain it. If it's a server, you need typically some system administrator behind. If it's a hardware object such as a camera or a NAS, you need a maintenance contract. Having a device connected to the Internet without any maintenance is asking for troubles. This is the only wrongdoing here for WD: not informing their customer that "end of life support" strictly means "DO NOT CONNECT ANYMORE TO THE INTERNET YOU FOOLS!"

brailsafe 5y ago

oof

SilverRed 5y ago

This should really trigger some kind of mass recall like what is done for cars when there is a safety issue. WD should be obligated to try to make contact with every user of the product to refund them.

zelon88 5y ago
I understand the sentiment, but the reality of the situation is if your WD device is hacked while on your home LAN network, you have a much bigger security problem than where your data isn't.
- blincoln 5y ago
  I don't use this specific WD product, but I've had some other network devices automatically and silently add port-forwarding rules to my router using uPnP, even though I never planned to access them from the internet. Maybe that's what happened here?

Santosh83 5y ago

Dumb hard disks are still fine I'd guess. Just don't go for any "smart", connected or networked device. I have several plain backup HDDs from WD and they, IME, have been more reliable than Seagate from a hardware point of view.

dividedbyzero 5y ago
USB HDDs are definitely not a replacement for a lot of NAS use cases.
- noxer 5y ago
  And a NAS is not a replacement for a backup.

bjt2n3904 5y ago

So it's got to be publicly accessable? A NAT'd device can't get hit from the outside?

Scoundreller 5y ago
Doesn’t seem to be what’s happened here. These WD devices were phoning home on scheduled intervals and it appears that got issued a factory-reset command, but only at the “quick” format level so everything might still be there but will need to go through a recovery procedure.
- SOMA_BOFH 5y ago
  they should stop phoning home if the device is end of life.
- londons_explore 5y ago
  I would take a guess this is not a 'hacker', but instead some mistake by a WD employee who was changing serverside software/config. Maybe even a disgruntled employee trying to wreak havoc...

ksml 5y ago

The WD response to the original bug report (from https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/): > The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012. These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle. So support can be discontinued after two years after introducing a product??? That's ridiculous. It's not even like this was a one-off product and they're no longer supporting that line of work. WD still sells MyBooks.

gogopuppygogo 5y ago
Support can be ended at any time and leave you hanging when relying on proprietary software. The fallout from this will be worse for western digitals brand than just patching the cloud service or smartly shutting it off if they weren’t going to support it.
- makeitdouble 5y ago
  If they sold it in the EU I think legally they have at least 2 years of support to do. Assuming the software not working directly affects the devices sold abilities.
  - qwertox 5y ago
    I don't think so. The seller (not the manufacturer) has to make sure that the device is free of faults for up to two years. The first 6 months it's up to the seller to prove that the device had no issues in the first place, afterwards it it up to the buyer to prove that the device was faulty to begin with. The manufacturer can only provide a warranty and exclude a lot from it. Like Motorola does with the batteries of the smartphones, which only have 3 months of warranty. The seller has to cover the 2 years. There is no obligation to support a device, like to provide firmware to fix bugs. If the hardware/firmware has a bug, it is a defect, which entitles you to a fault-free replacement within 2 years.
    - 5y ago

xroche 5y ago

> That's seriously messed up. I'd have to very seriously second-guess buying anything that involves software of any kind from this company. If you connect a device to the Internet, you must maintain it. If it's a server, you need typically some system administrator behind. If it's a hardware object such as a camera or a NAS, you need a maintenance contract. Having a device connected to the Internet without any maintenance is asking for troubles. This is the only wrongdoing here for WD: not informing their customer that "end of life support" strictly means "DO NOT CONNECT ANYMORE TO THE INTERNET YOU FOOLS!"