4 ms·

The following is the key new information here. This is a shocking response to a very, very serious issue. I will NEVER buy a Western Digital device of any kind.

by mdoms 5y ago

The following is the key new information here. This is a shocking response to a very, very serious issue. I will NEVER buy a Western Digital device of any kind. ----- Western Digital’s brief advisory includes a link to an entry in the National Vulnerability Database for CVE-2018-18472. The NVD writeup says Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug. “It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,” NVD wrote. Examine the CVE attached to this flaw and you’ll notice it was issued in 2018. The NVD’s advisory credits VPN reviewer Wizcase.com with reporting the bug to Western Digital three years ago, back in June 2018. In some ways, it’s remarkable that it took this long for vulnerable MyBook devices to be attacked: The 2018 Wizcase writeup on the flaw includes proof-of-concept code that lets anyone run commands on the devices as the all-powerful “root” user. Western Digital’s response at the time was that the affected devices were no longer supported and that customers should avoid connecting them to the Internet. That response also suggested this bug has been present in its devices for at least a decade. “The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012,” reads a reply from Western Digital that Wizcase posted to its blog. “These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle. We encourage users who wish to continue operating these legacy products to configure their firewall to prevent remote access to these devices, and to take measures to ensure that only trusted devices on the local network have access to the device.”

Saris 5y ago
To be fair pick any commercial NAS device and it probably has vulnerabilities somewhere. Just don't go and expose all your stuff to the internet.
- JamesonNetworks 5y ago
  I haven't heard how these people are actually being exploited. When I read the CVE, it makes me think javascript in the browser is reaching out over their LAN and hitting their NAS boxes, but I can't be sure that's whats happening. I can't imagine all these users set up port forwarding or UPnP on their MyBook Live. I would imagine a person buys that type of device because they don't want to or know how to do that kind of management. I'm curious to hear the details about the nuts and bolts of the exploit.
  - deleted 5y ago
    [deleted]
  - YuccaGloriosa 5y ago
    The whole point of my book live was that the user could access their files from remote locations. If I remember correctly the app was called WD2go or something similar. No doubt by setting up this service on their box, it opened up the path to the net. WD after some years then shut down that service, leaving the hole open.
    - YuccaGloriosa 5y ago
      And it's all probably going to happen again with Seagate. "As of May 15, 2021 the Seagate Access feature of Seagate NAS products will be discontinued. Specifically, the Seagate Access service, Seagate Access through Seagate Sdrive, Seagate Access through Seagate Media App, and Seagate MyNAS will no longer be available after May 15, 2021 at midnight Central European Time. Additionally, customer support for the Seagate Access service will also be discontinued. The removal of this service means that access to all Seagate NAS devices via the Seagate Access web portal, Seagate Sdrive, Seagate Media App, and Seagate MyNAS will no longer function. However, you will not lose remote access to the files on your Seagate NAS since it can be configured and accessed using the FTP/SFTP service. Similarly, your Seagate NAS will not change for standard network access within the home or office network using common network protocols on macOS and Windows. Please know that we remain grateful for your purchase of a Seagate NAS and hope you continue to enjoy it despite this change to remote access via Seagate Access, Sdrive, Seagate Media App and MyNAS. For questions, please contact https://www.seagate.com/contacts/ https://www.seagate.com/contacts/. Cordially, The Seagate NAS Team"
- hsbauauvhabzb 5y ago
  To be fair, your bank probably has vulnerabilities. Just don’t go storing your money in a bank.
  - hexa22 5y ago
    Your bank has robust backup systems. If it gets hacked they just untransfer the money.
    - hsbauauvhabzb 5y ago
      Lol. No, they don’t roll back transactions.
  - tracerbulletx 5y ago
    Hopefully that vulnerability isn't an api endpoint called resetBalanceToZero created intentionally do be public to any one that can connect.
claviska 5y ago
A two to four year support life for hardware seems ridiculously low. This reflects very poorly on WD, even if the exploit wasn’t discovered until the hardware was six to eight years old.
- hsbauauvhabzb 5y ago
  This. If a security vulnerability is significant enough, it should be fixed even in EOL products. I believe Microsoft did this for bluekeep as far back as server 2003. An authenticated, stored XSS on the admin portal of a CMS? Meh. A root remote code exploit on a device which is commonly found plugged into the internet? Definitely.
- takeda 5y ago
  Somebody mentioned to make requirement that if companies want to discontinue supporting a product they should be required to open source the code.
  - wmf 5y ago
    The chance that "the community" will create patches and users will somehow find and install those unofficial patches is very low. We need to set our sights higher than this.
    - takeda 5y ago
      If product is popular there will be always someone. If I was an user, I could patch it up myself (and I'm sure most people here would be able to, we're on HN).
gruez 5y ago
>I will NEVER buy a Western Digital device of any kind. You're going to rule out all WD products (even the SATA/USB/NVMe, non-networked variety) because their NAS line had 0days? That's like swearing to never buy any philips lightbulbs if their IOT lightbulbs got hacked. I guess if you want to do this to punish WD, that's your prerogative, but it's not really anything rooted in rationality.
- yjftsjthsd-h 5y ago
  In fairness, there are other reasons to avoid WD spinning rust: https://news.ycombinator.com/item?id=22935563 https://news.ycombinator.com/item?id=22935563 And, I dunno, if that's how they conduct business I'm not sure I want to try their other stuff and find out what corners they cut there.
- treesprite82 5y ago
  > because their NAS line had 0days? This vulnerability was reported in 2018 and remains unfixed, if I'm understanding correctly.
  - sodality2 5y ago
    Zero-day, one-thousand-day, it's all the same to WD
    - phire 5y ago
      "It's the customer's fault, they shouldn't be using old devices which we stopped supporting almost immediately after we stopped selling them" -- WD, probably.
- mdoms 5y ago
  > You're going to rule out all WD products (even the SATA/USB/NVMe, non-networked variety) because their NAS line had 0days? No, I'm ruling it out because of how they responded to it.

by mdoms 5y ago

Saris 5y ago

To be fair pick any commercial NAS device and it probably has vulnerabilities somewhere. Just don't go and expose all your stuff to the internet.

JamesonNetworks 5y ago
I haven't heard how these people are actually being exploited. When I read the CVE, it makes me think javascript in the browser is reaching out over their LAN and hitting their NAS boxes, but I can't be sure that's whats happening. I can't imagine all these users set up port forwarding or UPnP on their MyBook Live. I would imagine a person buys that type of device because they don't want to or know how to do that kind of management. I'm curious to hear the details about the nuts and bolts of the exploit.
- deleted 5y ago
  [deleted]
- YuccaGloriosa 5y ago
  The whole point of my book live was that the user could access their files from remote locations. If I remember correctly the app was called WD2go or something similar. No doubt by setting up this service on their box, it opened up the path to the net. WD after some years then shut down that service, leaving the hole open.
  - YuccaGloriosa 5y ago
    And it's all probably going to happen again with Seagate. "As of May 15, 2021 the Seagate Access feature of Seagate NAS products will be discontinued. Specifically, the Seagate Access service, Seagate Access through Seagate Sdrive, Seagate Access through Seagate Media App, and Seagate MyNAS will no longer be available after May 15, 2021 at midnight Central European Time. Additionally, customer support for the Seagate Access service will also be discontinued. The removal of this service means that access to all Seagate NAS devices via the Seagate Access web portal, Seagate Sdrive, Seagate Media App, and Seagate MyNAS will no longer function. However, you will not lose remote access to the files on your Seagate NAS since it can be configured and accessed using the FTP/SFTP service. Similarly, your Seagate NAS will not change for standard network access within the home or office network using common network protocols on macOS and Windows. Please know that we remain grateful for your purchase of a Seagate NAS and hope you continue to enjoy it despite this change to remote access via Seagate Access, Sdrive, Seagate Media App and MyNAS. For questions, please contact https://www.seagate.com/contacts/ https://www.seagate.com/contacts/. Cordially, The Seagate NAS Team"
hsbauauvhabzb 5y ago
To be fair, your bank probably has vulnerabilities. Just don’t go storing your money in a bank.
- hexa22 5y ago
  Your bank has robust backup systems. If it gets hacked they just untransfer the money.
  - hsbauauvhabzb 5y ago
    Lol. No, they don’t roll back transactions.
- tracerbulletx 5y ago
  Hopefully that vulnerability isn't an api endpoint called resetBalanceToZero created intentionally do be public to any one that can connect.

claviska 5y ago

A two to four year support life for hardware seems ridiculously low. This reflects very poorly on WD, even if the exploit wasn’t discovered until the hardware was six to eight years old.

hsbauauvhabzb 5y ago
This. If a security vulnerability is significant enough, it should be fixed even in EOL products. I believe Microsoft did this for bluekeep as far back as server 2003. An authenticated, stored XSS on the admin portal of a CMS? Meh. A root remote code exploit on a device which is commonly found plugged into the internet? Definitely.
takeda 5y ago
Somebody mentioned to make requirement that if companies want to discontinue supporting a product they should be required to open source the code.
- wmf 5y ago
  The chance that "the community" will create patches and users will somehow find and install those unofficial patches is very low. We need to set our sights higher than this.
  - takeda 5y ago
    If product is popular there will be always someone. If I was an user, I could patch it up myself (and I'm sure most people here would be able to, we're on HN).

gruez 5y ago

>I will NEVER buy a Western Digital device of any kind. You're going to rule out all WD products (even the SATA/USB/NVMe, non-networked variety) because their NAS line had 0days? That's like swearing to never buy any philips lightbulbs if their IOT lightbulbs got hacked. I guess if you want to do this to punish WD, that's your prerogative, but it's not really anything rooted in rationality.

yjftsjthsd-h 5y ago
In fairness, there are other reasons to avoid WD spinning rust: https://news.ycombinator.com/item?id=22935563 https://news.ycombinator.com/item?id=22935563 And, I dunno, if that's how they conduct business I'm not sure I want to try their other stuff and find out what corners they cut there.
treesprite82 5y ago
> because their NAS line had 0days? This vulnerability was reported in 2018 and remains unfixed, if I'm understanding correctly.
- sodality2 5y ago
  Zero-day, one-thousand-day, it's all the same to WD
  - phire 5y ago
    "It's the customer's fault, they shouldn't be using old devices which we stopped supporting almost immediately after we stopped selling them" -- WD, probably.
mdoms 5y ago
> You're going to rule out all WD products (even the SATA/USB/NVMe, non-networked variety) because their NAS line had 0days? No, I'm ruling it out because of how they responded to it.