10 ms·
Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live devices
- oldgradstudent 5y ago> As the following script shows, however, a Western Digital developer created five lines of code to password-protect the reset command. For unknown reasons, the authentication check was cancelled, or in developer parlance, was commented out as indicated by the double / character at the beginning of each line. function get($urlPath, $queryParams=null, $ouputFormat='xml'){ // if(!authenticateAsOwner($queryParams)) // { // header("HTTP/1.0 401 Unauthorized"); // return; // }
- deleted 5y ago[deleted]
- ivrrimum 5y agolol, this is why TDD should be government mandated for companies which have reached at least 1 million users or government systems.
- CodeWriter23 5y agoNever thought I’d see Ars explain what “commenting out” means.
- beerandt 5y agoIt's not the site it used to be. Forums are all but dead. Comments alone have kept me from visiting the site for a while now. Used to be one of the sites I'd check daily, now I don't even like to click through on articles like these.
- CodeWriter23 5y agoI don’t begrudge the founders taking their payday. That said, I really do miss the special place they made.
- beerandt 5y agoOf course not. But it's the restaurant you hate to go to now, because it just reminds you of how good it used to be.
- axiosgunnar 5y ago> ouputFormat
- genghizkhan 5y agoWhy would someone comment out authentication for reset? I mean, what possible reason is there for doing so? It doesn't make security any better and it's not something which impacts day-to-day performance in any way.
- sgerenser 5y agoIf a user forgets their password, they still need a way to factory reset so as not to brick the device. Of course, this should involve, say pressing and holding physical button on the device. Just commenting out the password check was probably a lot easier.
- tyingq 5y agoGuessing this is right. While neither would be perfect, they could have at least checked for "request coming from the same local subnet" or "enter MAC address as password", or similar.
- genghizkhan 5y agoAfaik these devices do have a physical reset pinhole button.
- bellyfullofbac 5y agoThe most infuriating answer would be maybe they were testing the restore function, and was tired of entering the test username and password over and over again. And then the "I'll just comment it out for my tests" got commited, and built, and deployed.
- prirun 5y agoIf one of these devices is sold, the new owner may want or need to do a reset but doesn't know the password.
- genghizkhan 5y agoThere exists a physical reset pinhole button on these devices.
- tyingq 5y agoA post with pretty deep detail: https://censys.io/blog/cve-2018-18472-western-digital-my-book-live-mass-exploitation/ https://censys.io/blog/cve-2018-18472-western-digital-my-boo...
- flatiron 5y agofirst HN article had a bunch of people saying there were devices behind a NAT with no port forwarding that had the issue, this doesn't describe what happened there (if that actually happened)
- Jedd 5y agoThe commented out function - if a verbatim copy of deployed code was in fact presented - seems to not include function name and opening brace, but does comment out the function proper and closing brace, which, and it's been a while since I did anything with PHP, would mean a syntax error on run, right?
- Gaelan 5y agoHere's the snippet from the article: function get($urlPath, $queryParams=null, $ouputFormat='xml'){ // if(!authenticateAsOwner($queryParams)) // { // header("HTTP/1.0 401 Unauthorized"); // return; // } The closing brace there corresponds to the if. The rest of the body of the function, and its closing brace, are outside the snippet included in the article.
- Jedd 5y agoAh, thanks - I'd missed that.
- wizzwizz4 5y agoIt comments out the `if` block, but not the rest of the function.
- alexwasserman 5y agoSnippet supplied in the article: function get($urlPath, $queryParams=null, $ouputFormat='xml'){ // if(!authenticateAsOwner($queryParams)) // { // header("HTTP/1.0 401 Unauthorized"); // return; // } That if statement is checking for authentication before running the rest of the function. Just the if check is commented out. Assuming here the rest of that function would come below it, with a closing brace. ie: function get($urlPath, $queryParams=null, $ouputFormat='xml'){ // if(!authenticateAsOwner($queryParams)) // { // header("HTTP/1.0 401 Unauthorized"); // return; // } do; something; here; then; }
- Sanzig 5y agoThe commented-out closing brace is for the if statement, not the whole function. The rest of the function was snipped, you can see the whole thing here: https://paste.debian.net/plainh/7630c424 https://paste.debian.net/plainh/7630c424
- eqvinox 5y ago> Abdine has come up with a plausible theory—that one hacker first exploited CVE-2018-18472 and a rival hacker later exploited the other vulnerability in an attempt to wrest control of those already compromised devices. Excluding straight vandalism, I can't really come up with another reason for the reported sequence of events. Presumably the first attacker wanted to build a botnet (which is actually something they can draw profit from), and a competitor wanted to prevent them from doing that. Otherwise — again, excluding straight vandalism — what is the benefit of wiping the devices? Having your preexisting botnet target/scan and exploit these devices isn't free. What else could they have been trying to gain?
- tyingq 5y agoWatching the world burn. There are plenty of examples of worms/viruses that bring no benefit to the creator. I know you said "excluding", but it's popular. Alternatively, some misguided "white knight" idea. Maybe the factory reset turns off the "open to the internet" setting.
- sigzero 5y agoYup, some people just want to see the world burn.
- shadilay 5y agoIncompetence probably, there's really no downside when experimenting with others' devices (aside from legal).
- theropost 5y agoOuuf, I was wondering what happened to all my data on my old My Book live - I'm okay with my own incompetence or network security, however I'm not okay with WD's incompetence
- vxNsr 5y agoJust curious, did you have remote (WAN) access set up? I have one of these at my parents house, I had them unplug it, once I read this, but I was always wary of turning on remote access, as in it would only be accessible from the LAN, I haven't had a chance to go back in and check if it was hit, but I'd like to think that without remote access turned on it wasn't vulnerable.
- gentleman11 5y agoI have 2 backups of most data but these stories make me worry. It is so time consuming. Easy to forget to maintain, & test.
- iJohnDoe 5y agoThe developer probably commented out the authentication begrudgingly because he was requested to do so. If a user forgets their password or buys a used drive then they won’t know the password. It’s common in the hardware industry to be able to factory reset a device somehow.
- kova12 5y agoOr he just was working on a feature, and got annoyed with password prompts. Commented out authorization code, then forgot to comment it back in
- SketchySeaBeast 5y agoAnd that's why the first person who performs the PR code review should be the person requesting it.
- MR4D 5y ago> If a user forgets their password or Isn't this the reason for a hardware reset button? Having this available over the internet is probably negligent.
- beerandt 5y agoHow common is it now for a hardware button that isn't just dedicated input for software?
- MR4D 5y agoProbably common, but connecting that function to the web (via PHP in this case) is pretty stupid. I would think it would run a firmware function to do the resetting, and if not that, then some sort of sell script that is not callable by their web interface. Due to all this stupidness, my weekend is going to be consumed by trying to find out if my Synology has something stupid in it (assuming I can even figure that out). So my trust in "personal" network storage devices has been shattered. Hopefully Synology is not as dumb.
- ksec 5y agoDoes anyone know what happens to those Data? Do WD offer some sort of Data Rescue Services?
- rincebrain 5y agoAs far as I can tell, WD's response is "too bad so sad you should have bought a newer product", so I don't think they offer affected people any sort of recovery gratis. (I suspect this will bite them in the ass in the court of public opinion, but we'll see.)
- vxNsr 5y agoNot sure what "factory reset" means, likely just deleting the MBR or something like that, the data is likely recoverable using consumer data recovery tools.
- sgerenser 5y agoNot if encryption was enabled. Anyone know if these devices had full disk encryption?
- vxNsr 5y agoI don’t recall seeing that option in the one I set up for my parents.
- ksec 5y agoYes, assuming the best case scenario it should be easy for us on HN. But for 99% of those customer they likely think all of their Data are gone. ( It will be worst if they start writing more data on the empty drive ... ) And I dont seems to read any site that offer basic advice as disconnection, power down and dont touch it for now. No knowing what to do is casing panic.
- vxNsr 5y agoI did get an email from western digital saying turn it off. Granted it was 4 days after reports first went live about this but still. It’s something.
- pkulak 5y agoPetabytes of personal data on the open internet secured with PHP. Holy crap.
- lmilcin 5y agoYep. We are talking about cloud services revolution but the sad fact is that I can't trust these incompetents with my shopping list and need to maintain all my data and backups myself.
- ascagnel_ 5y agoIt's not that it's secured with PHP, it's that it's not secured properly. Given the scale of this screw-up, there's nothing tying it to PHP, and it could've been done in the HN language/platform du jour.
- pkulak 5y agoMaybe it's not the language, maybe it's all correlation and no causation, but software that happens to have been written in PHP does not have a stellar security track record. My logs don't fill up with lines like: HTTP POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php for no reason whatsoever.
- johnnyApplePRNG 5y agoI am kind of surprised they didn't ransomware them all. Is it not possible for some reason on these limited devices?
- mikeho1999 5y agoI'd love to take a moment to talk about the quality of the code (assuming that the full code listing that the Ars article links to is accurate). It's pretty clear that there are no coding standards, sparse comments (literally just 1), lots of mixed tab/spacing, misspelled names, etc. Furthermore, the fact that this got into production shows that either the code wasn't even reviewed prior to release and/or it wasn't reviewed carefully. I think this goes to a much larger issue of devices in this so-called IoT world we live in now. So many of these devices are built by "hardware-first" companies, who oftentimes put very little budget, time or emphasis on the software side of things. As people's daily lives depend more and more on IoT devices, I think this should be more and more of a concern: it doesn't matter how good the hardware is and/or how cost efficient a company's hardware production capability is if you don't value the quality in the software that runs said hardware. (Full Disclosure: I'm a full-time independent software developer who has worked on many IoT projects, working directly with hardware and device manufacturers)
- shortformblog 5y agoThis is probably also reflected by the fact that they stopped patching it relatively early in its life. Three years of patches for what is effectively an internet-connected hard drive, presumably one that its target audience is going to be using for many years as something that “just works,” reflects a disinterest by Western Digital in living up to its own sales pitch.
- tibbon 5y agoRight - if the hardware is no longer selling (due to missing sales targets) then there's little incentive for the companies to still invest significant resources into maintaining it. Of course one option would be to open source it entirely and turn it over the community for long term support, but the companies like holding onto whatever little bits of IP they can (even if they are largely just implementing open source software to begin with, and nothing super speceial). This is a problem. I don't know the solution, except that companies should really commit to LTS support of things no matter the sales targets.
- deleted 5y ago[deleted]
- racl101 5y agoCan anyone clarify? Is this a vulnerability of all My Book drives or just ones that connect to a cloud / online service? I have one of these but haven't plugged it in for a while. However, I don't remember using any online service with it. It just had a bunch of movies.
- ayngg 5y agoIt applies to the "My Book Live" version.
- ALittleLight 5y agoI would've thought that destroying your users' data in vast amounts would be bad for the company. Surely this would shatter user trust? Who would buy something like this from Western Digital in the future? And yet, their stock price seems unaffected. It was slightly up, though just in the way it randomly fluctuates, on the day of the announcement.
- throwawayboise 5y agoIt's a defect in an old product that they don't sell or even support anymore. They are still selling hard drives by the millions to server and storage OEMs. Consumers mostly are not even buying spinning drives anymore. It's all Flash or SSD.
- dehrmann 5y ago> Consumers mostly are not even buying spinning drives anymore. It's all Flash or SSD. On one hand, they own Sandisk. On the other, no one outside of the industry knows that.
- fullstop 5y agoI wonder if they were looking for wallet.dat files?
- fuzzfactor 5y agoIs everybody sure every sector of their valuable data has been overwritten?