20 ms·
Another 0-day looms for many Western Digital users
- WalterBright 5y ago"they discovered a chain of weaknesses that allows an attacker to remotely update a vulnerable device’s firmware with a malicious backdoor" Once again, this is why firmware needs a hardware write-enable switch, not a software one. Cue the arguments that remote updating is needed to fix bugs that allow remote updating. :-/
- WalterBright 5y agoI want hardware switches for: 1. firmware updating 2. write-enable for disk contents 3. turning the microphone on 4. turning the camera on In a surprise development, the webcam I just bought comes with a flip-up lens cap. Yay! It's Nexigo, they deserve a shout-out for this. But in the Dept of Half-Assed Features, the lens cap does not disable the microphone, so I still have to unplug it when not in use.
- bjt2n3904 5y agoA "firmware update" hardware switch is challenging to implement. A "read only" switch means you have to separate your firmware and your configuration into two separate storage devices. Hardware switches are easier for microphones and cameras, because you literally cut the power for a device.
- Scoundreller 5y agoChallenging, but almost always possible. Most flash chips have a write-enable line that you can put a switch on. Usually have to cut a trace but often can avoid soldering right to the legs by following traces. Was a common thing to do to receivers (“Integrated Receiver Decoders”) back in the paytv days. Thankfully they had firmware on a parallel eeprom and config stuff on a smaller serial eeprom (that could handle 1m writes instead of 1k writes). Receivers could have a lot of wires especially after they implemented some lock-detection that had to be countered with some 74ac logic that could disrupt the 2nd step of starting a write job. Should be doable for something like a router or cable modem, but maybe not on something like these WD drives. Like a mod chip without having to worry about the vendor trying to counter you. Of course you’re still screwed if something is only non-persistent but at least any issues are resolved with a simple reboot.
- ComputerGuru 5y ago> A "firmware update" hardware switch is challenging to implement. No, it’s not. The actual low-level chip on the flash has a separate pin that must be connected to ground to enable writes.
- bjt2n3904 5y agoI'll tell you what! You make an embedded Linux device with a read only partition based on a hardware switch. You figure out all the bugs that are caused by software not being able to write temporary files to disk. You figure out how to do configuration management on a separate system with something more complicated than a ten line YAML file. Want to change your password? That's /etc/shadow -- did you some how rig that up to be writeable, while the rest of /etc was not? Also, since I presume your management decided to not let the users have root, because of course they did... You'll need to resort to software tricks to make sure the user can't change the root password. Oh, and remember. No software read only tricks. Hardware switch. Please let me know when you finish, I'll help audit your system. Last edit: To all the reply guys, yes. I know it's possible. My statement is it isn't easy, and there are many challenges. (Especially compared with the simplicity of a power cut switch to a webcam.) I can make you a microcontroller with a firmware update switch that blinks a light. By the time you scale that up to a full fledged embedded Linux system with a board designed in house, with weird hardware that is keeping you back on Linux 3.16 because nobody knows how to port your drivers, with cryptographically signed updates, fault tolerant firmware slots, and a nasty stack of software developed by web devs that can't fathom why they can't write to disk, that has to interoperate with legacy hardware and systems, that has a management bureaucracy that can't understand why it's taking so long to implement the new media server plugin, and devices in the field aren't getting automatic updates... No. No it's not easy. Part way through, management will kill the project, you'll end up with a switch that's read in software, and eventually wind up on the front of HN as someone who did security wrong. But by all means, take your "easy" idea to WD and tell them you'll have it working on their devices by Q1 2022.
- ComputerGuru 5y agoI’ve already done it, and it’s not that hard. Others have done more. It’s the best way to avoid SD card or flash write wear. My production devices default to read-only mode and must have a dip switch toggled before any changes persist beyond the shadow ram-resident overlay that resets at power cycle. (Aside: As for my idea of a configuration system, I’ve developed entire [incremental!] build systems that take a kernel source tree and configuration files and generate fully boot-ready images with drivers, packages, and even GUI support down to specifying the themes and customizing panel layouts, and more via a fully declarative syntax. The images have been booted on commodity hardware not under our control spanning some twenty-plus years of technology on more than a 100k machines. This is HN: not everyone is merely an armchair expert in whatever the topic of discussion is for today. It can be beneficial to assume expertise is out there and seek it rather than deny things are possible.)
- edoceo 5y agoChallenging? I think you mean fun.
- LeifCarrotson 5y agoThe firmware and configuration are already split into several devices. These machines have Arm Cortex A9 and similar processors that go through several stages to start up: First, some internal boot ROM, likely with fuses burned in for the particular IO configuration, reads a bootloader (likely Das U-boot) from external flash memory. That first-stage bootloader initializes the parallel/SPI NAND/NOR flash interface and DRAM controllers, and then launches the second-stage bootloader. The second-stage bootloader uses those memory controllers to read the firmware image out of memory into RAM, then executes it. If you want to update the firmware - more precisely, to change the location or signature of the image that should be loaded by the second-stage bootloader - it would be trivial to add a check for a GPIO switch to allow or deny changes.
- caleblloyd 5y agoI recently bought USB off/on switches [1] for the external webcam and microphone on my desktop. I think they control the power line and not the data lines, but they do the trick. Reduces port fatigue and USB orientation frustration. [1] https://www.amazon.com/gp/aw/d/B08M44D79T https://www.amazon.com/gp/aw/d/B08M44D79T
- jareklupinski 5y agofunny story, i just spent a day troubleshooting why a microcontroller would not reset after cutting its power lines turns out it was leeching power from another still-active device through its data pins! there was not enough power flowing through this way to actually do something, but there was enough to keep the brownout detector from kicking in and resetting the chip
- formerly_proven 5y agoI mirrored the pinout of an AVR once and spent a few hours debugging why ISP wasn't working (so I unsocketed it for programming) and all the pins were wrong. It worked just fine pulling ground and Vcc from the I/O pins just opposite. These are of course fairly low-power 1.8-5 V devices, so when run on 5 V there is a huge margin for the supply voltage.
- phaker 5y agoYou were powering it through the protection diodes. Some 10-15 years ago someone built dirt simple radio tags this way. Just a microcontroller, with a capacitor and an antenna trace connected to some io pin. I loved that hack.
- myself248 5y agohttps://scanlime.org/2008/09/using-an-avr-as-an-rfid-tag/ https://scanlime.org/2008/09/using-an-avr-as-an-rfid-tag/
- 5y ago
- reaperducer 5y ago2. write-enable for disk contents It's funny how such basic things from the past were thrown away. Every floppy disk ever had this. However, i also believe that if such a thing existed for modern gear, it would only be used by 1% of people, and even then, mostly accidentally, resulting in millions of trouble tickets. So I'm not sure what the compromise is.
- WalterBright 5y agoI don't buy the argument that if not everyone uses it, nobody should get it. BTW, I would read TV repair manuals as a kid (yes, weird). There was always the "check to see if it is plugged in". Plugging TVs in made a lot of money for service people. I see similar things in car manuals for car won't start. "Put gas in it." Edit: This was back in the days when you could repair a TV with a soldering iron and a screwdriver. Every hardware store had a tube testing machine. I'd have fun by randomly swapping the tubes that fit in the same socket and seeing what effect that would have on the TV's operation.
- Stratoscope 5y agoAnd of course, blow the dust out of the connector! https://devblogs.microsoft.com/oldnewthing/20040303-00/?p=40423 https://devblogs.microsoft.com/oldnewthing/20040303-00/?p=40... I was also the family "TV tube test person" as a kid. I must have been around 6 or 7. For the young'uns, TV sets used to have tubes and hand-soldered point-to-point circuitry. Just like an ENIAC, a tube TV would always "go on the fritz" as the tubes burned out. My dad showed me how to pull out all the tubes, and we would put them in a cigar box and go to the little corner grocery, which had a tube tester in front. I would dial up all the settings for each tube and test it, and we would buy replacements for the bad ones. Take them back home and I would plug them in, and the TV worked again! Dad was always generous and made sure I got credit for it. BTW did you ever get to discharge the high voltage connection to the picture tube with a screwdriver and wire with alligator clips? One clip to chassis ground, the other to the screwdriver, then slip the screwdriver under the rubber insulated connector, and BANG! https://en.wikipedia.org/wiki/ENIAC https://en.wikipedia.org/wiki/ENIAC https://en.wikipedia.org/wiki/Vacuum_tube https://en.wikipedia.org/wiki/Vacuum_tube
- luke2m 5y agoMy new Lenovo has a built in camera cover which was a nice surprise, but only a software hotkey for the mic.
- fsflover 5y ago> I want hardware switches for Here you go: https://puri.sm/security/ https://puri.sm/security/.
- folmar 5y agoAlso PinePhone.
- pengaru 5y agopinephone's hardware switches are kind of an afterthought and not particularly accessible, being behind the battery cover in the form of a tiny block of DIP switches better suited to one-time configuration.
- fsflover 5y agoExactly. With Pinephone, you will not be able to switch on your microphone while receiving a phone call, unlike with Librem 5.
- adolph 5y agoBug or feature is that?
- fsflover 5y agoDepends on whether you need a microphone during a phone call.
- dotancohen 5y agoIt's usually the wife calling, and during those calls she's not listening to a word I say anyway.
- jackpirate 5y ago> 3. turning the microphone on Most people are surprised that speakers can be used as microphones by "running them in reverse", and so you also need a hardware switch for your speakers to maintain privacy.
- zootboy 5y agoWhile technically true, in most real life situations, this is not possible to exploit. If the speakers have an amplifier in line with them, they will not work in reverse. If the speakers are built in to a laptop, the driver circuitry will not allow them to work in reverse. Pretty much the only way this might be possible is if you had an audio port that was capable of functioning as both a TRS output and a TRS input (not a TRRS "headset" port), and had a set of headphones plugged into said port, and had a piece of malicious software that was able to reconfigure the port to act as an input.
- WalterBright 5y agoWhen I was a boy I'd hook up a speaker to a phono input, which made a great PA system! An even longer wire attached to the phono input turned any amplifier into an AM radio. A simple intercom is just two speakers, one on each end, wired together in a loop.
- pengaru 5y agoNice! In my childhood I took apart a broken WalkMan and discovered if I connected a random ~8" loudspeaker driver in the tape head's place, I could eavesdrop on my siblings and parents from across the house by placing the speaker against the walls or floor, complete with volume control and everything. It was incredibly sensitive, and infuriating to learn how much everyone was constantly lying and talking behind eachother's backs at that age.
- gruez 5y ago>and had a piece of malicious software that was able to reconfigure the port to act as an input. That's actually a feature of many realtek sound drivers. https://www.reaper-x.com/2012/02/13/how-to-remap-retasking-realtek-onboard-jacks-ports/ https://www.reaper-x.com/2012/02/13/how-to-remap-retasking-r...
- agilob 5y ago>3. turning the microphone on instead we have undocumented microphones for 'future purposes'. Thanks Google
- hsbauauvhabzb 5y agoAny chance of a citation on this? I’m interested in reading more.
- ManBlanket 5y agoMy workstation came equipped with a removable piece of masking tape I found in the supply closet.
- elric 5y agoMicrophones are ... tricky. I remember seeing a proof of concept of using laptop speakers as a microphone. And more recently, I read about using the mouse to "listen" in on the environment. Apparently the sensors in mice are sensitive enough to detect a lot of vibration. Not good enough to listen in on a conversation, but give it time ...
- laurent92 5y agoAh, the flip-up for the camera. Still records your voice and keystrokes, proof-of-concepts have demonstrated it is possible to capture passwords using sounds. Also the driver can contain malware, and anyway the camera itself can be on battery even if unplugged and use 5G now that the billing is per-data and not per-sim, or Sigfox networks, all of this for less than 10€ of component out of a 80€ webcam. I really don’t understand why switches are not proposed by the largest vendors.
- brokenmachine 5y ago>I really don’t understand why switches are not proposed by the largest vendors. Because paying customers don't understand or care about privacy. Facebook is still a thing. Let that sink in.
- sundvor 5y agoMy Streamdeck is great for turning microphone off at a system level. Coupled with eg OBS Studio and using virtual camera as source, where you can have several scenes available for quick switching in a pinch, you get a much better control for meetings. I highly recommend them for remote working software engineers; the macros are amazing (eg start camera, lights, open meeting software in one go - then another to shut it all down). You will still need to double check that all the mappings haven't changed for whatever reason, from time to time. (I'm on Win20/WSL2).
- Sniffnoy 5y agoDon't forget hardware switch for wireless networking. Laptops used to come with that...
- dotancohen 5y agoThe problem with the wifi switches was support. You would not believe how common it is for someone to flip those small switches accidentally and not even know its there. Then the support calls come in for wireless issues. The answer to "Did you check the wifi switch?" is almost always "What wifi switch?".
- duskwuff 5y agoAnd it only got worse when that moved to soft switches (e.g. "press Fn-F6 to toggle wifi"). Typically the on-screen feedback would only work in DOS, or would depend on a weird vendor utility, so there might not be any obvious indication when you switched it off.
- wccrawford 5y ago"Cue", not "Queue".
- deleted 5y ago[deleted]
- WalterBright 5y agoFixed.
- anonuser123456 5y agoThat might add an additional 1$ to the BOM. In quantity of 10 million, that's a lot of extra money for a feature that maybe 100 people will use. Not arguing against the idea, just saying that the economics will never work in favor of this.
- gowld 5y agoAdd $1 to BOM, add $2 to price, problem solved.
- anonuser123456 5y agoAs someone that works with OEMs in the semiconductor business... I wish this were true.
- WalterBright 5y agoThat's why I've suggested that every time you buy a disk drive, when posting a review, take off 1 star for no write-enable switch.
- tinus_hn 5y agoI suggest everyone who has a use for such a switch do that. But I think they already do that.
- crazygringo 5y agoI'm genuinely curious -- is there any empirical evidence to show that's the most effective approach? Because then the firmware can never auto-update, but needs to be manually and explicitly done -- flick the switch, apply the update, flick again. And clearly a significant proportion of people (probably a very large majority if we're being honest) will simply never update firmware. So which is the bigger threat: unpatched firmware, or firmware auto-update vulnerabilities? The answer doesn't seem intuitively obvious at all to me. But there must be stats available -- frequencies and severities of vulnerability categories, and how often people update firmware on non-auto-updating devices. So it doesn't seem terribly hard to compute an answer?
- deleted 5y ago[deleted]
- bscphil 5y agoSplit the difference. Automatically update devices until they are end-of-lifed, then send a last update that blows a fuse allowing automatic updates. Anything after that point requires a write switch to be flipped. Actually, preferentially they should be taken offline and the consumer should have to opt-in to leaving them connected to the Internet, but that's a whole separate issue.
- crazygringo 5y agoI don't know, that doesn't seem like splitting the difference -- it seems like it might be the worst of both worlds. Before EOL auto-update is a vulnerability, and after EOL security patches might still be made available for the absolute worst vulnerabilities, but now wouldn't get to practically anyone.
- foobar33333 5y agoAnd then not a single user ever updates their firmware which is probably even worse than auto updates. The real answer is crappy OEM hardware should not be exposed to the internet. Put it behind a gateway by a decent vendor like Apple or Google who will make sure it stays secure.
- causality0 5y agoProducts that rely on third party servers to function should be required to carry an expiration date that guarantees service and security patches up to that date.
- deleted 5y ago[deleted]
- sp332 5y agoThey still support this device and there is an OS update that closes the vulnerability. They are providing data recovery services to customers of the older devices. Would have been nice if they warned those customers about the vulnerability when they found out about it, even if the fix was to buy another $X00 product.
- ineedasername 5y agothere is an OS update that closes the vulnerability Not for all devices: The article indicates that some may not be compatible with OS 5 and that WD says those customers should buy a new one.
- MrStonedOne 5y agoand its a full rewrite of the OS that is missing some functionality used by users.
- naikrovek 5y agowho cares about missing functionality when compared with deletion of your data? surely deletion of data is worse alternative to losing the ability to theme the web UI, or whatever. this is why Microsoft has so many updates so often for Windows 10. security issues which require no intervention from the victim are VERY REAL, and when left alone, users will not update. this has been proven time and time again. A user can take no action and still be vulnerable today when they were not vulnerable yesterday. this WD instance is yet another example of users not knowing what is best for themselves; not knowing to update their devices, or to take their devices off of the internet. there are secure, free, easy-to-setup ways to access files over the internet on a NAS which does not have internet access... WD will hopefully force users to update in the future for internet connected devices, and for devices that go out of support, and can no longer receive updates, WD should take them off the internet as a final action, to protect the consumer. THIS EXACT SITUATION is why updates should be forced on users. nothing shoots itself in the foot as often or as thoroughly as a user that doesn't know what they're doing, believing they know what they're doing.
- deleted 5y ago[deleted]
- quijoteuniv 5y agoEvery time I read replies or comments from WD the less i want to buy anything from them again. Very disappointing as every few years i buy 1 drive that backsup all my previous backups plus the new stuff. So i guess all my drives are unsupported. Not buying any cloud solution, NAS ever. A company not taking care of its customers is either not worth investing or are about to go belly up anytime.
- coolspot 5y agoBest spinning hard drives though, especially after they acquired HGST.
- freeone3000 5y agoThe manufacturing of HGST got sold to Toshiba -- that's where you want to look for quality drives now. HGST is just another WD brand at this point.
- conductr 5y agoIs there a better alternative? Or are the competitors just a day away from their own disaster event?
- quijoteuniv 5y agoGood point, i did go for cheap and redundant with WD. Also i like to have spare power suplies, meaning 2 or 3 drives Within same line, will use the same. Did that with maxtor 15 years ago, those drives still work... but are 120GB. Not sure which is the brand to buy now. But it looks like is time for a change.
- foobar33333 5y agoNextcloud on a linux system is your best bet. And its a huge pain. You essentially have to learn devops and regularly check in to see everything is running correct. And then one mistake and your data is at risk. You also have to manage backups somehow which you want to be not on the same machine.
- 5y ago
- CodeWriter23 5y agoIMO if they have a point in time where they decide they will no longer provide security updates, they should adjust the MTBF calculation, setting the maximum possible lifetime to be the EOL on the software.
- chronogram 5y agoThat sounds ecologically disastrous. Although I remember when I once purchased a TV when they were still tubes, there was an additional €9 recycling fee at the time of purchase.
- CodeWriter23 5y agoNot if they extend the software EOL to match the life of the mechanicals.
- dec0dedab0de 5y agoThe video is pretty interesting, it looks like the nobody account was not meant as a backdoor, but the secret api is just doing authentication, without authorization. Couple that with having the api using the Linux auth and you have a problem. ...I wonder if it's doing pam or just reading the shadow file direcly, doesn't really matter When I first read there was a backdoor account I thought it would be one that was on purpose. At an old job about 15 years ago we used network equipment that had a vendor backdoor built in. Only reason we knew it existed was one of our engineers had recorded a remote session with the vendor's support team. The account gave you full admin access and didn't even show up as another logged in user. It was disturbing to say the least.
- coolspot 5y agoNetwork equipment vendor name?
- dec0dedab0de 5y agoCarrier Access It was the Adit 600
- oceanghost 5y agoSo, I've "owned" a PR4100 for 3 or 4 years. I wanted it because it supposedly supported hardware transcoding for Plex. Sadly the transcoding was limited to 5mbps h264-- the signal looked BAD. It was like watching confetti. Later the capability was removed altogether. Which is why I haven't been affected by these 0days as of late-- the damned thing is useless and therefore turned off.
- ineedasername 5y agoWhy not return it when it didn't work well for Plex?
- ClumsyPilot 5y agoOdds are by the time he was done mucking around with all possible plex settings, the return period has passed
- oceanghost 5y agoI happened to get it just before I moved, I just didn't have time to deal with it in the window-- and the other fellow is correct. I had assumed that it would be possible to tweak it to get better quality.
- seventytwo 5y agoWD has been cutting engineering corners for years. It’s finally catching up.
- atatatat 5y agoWho still uses this crap?!
- excalibur 5y ago"The people pay for the newest version, and the newest version fixes the vulnerability." -- Mitch McConnell
- reducesuffering 5y agoMy parents actually use this Western Digital MyCloud as a local backup because of concerns about data being exported out to cloud servers a la Apple, Microsoft, Google, etc. Are there any recommendations for good local backup solutions for middle aged people not great with tech? Edit: Needs auto-backups, so it has to be more than a USB or old computer.
- WalterBright 5y agoA USB stick works well, or a USB drive if more space is needed.
- reducesuffering 5y agoThe go-to standard for quite awhile. Unfortunately, it doesn't come with the convenience of auto-backups and runs the risk of being lost along with all the memories and data it contains.
- WalterBright 5y agoMake a copy of your parents' backup and keep it yourself. I have a friend whose grandparents took tons of film of him growing up. Then their house burned down, all lost. Give a backup to an offsite family member.
- eric__cartman 5y agoAn Intel NUC style computer with openmediavault, or other easy to use open source NAS solution is what I would use in that case. If you don't care about the small size of a NUC, an old office PC with a couple hard drives should do well.
- fulafel 5y agoSadly keeping a general purpouse server OS consistently secure and patched up is not realistic for "middle aged people not great with tech". I wonder if there are good affordable ways to outsource this...
- lokl 5y agoThere's no indication EasyStore is affected, right? Assuming not using any WD Backup software.
- fnord77 5y agowhen this whole unfortunate thing is done, will there be a lot of cheap WD nas drives on ebay?
- themodelplumber 5y agoI have a friend who is considering a refurb PC with openmediavault as a replacement for one of these. She isn't using the WD remote access tools, so it's not a security issue with the product, but more like an old-OS issue. I'm not sure if she plans to shuck the drive for use in the new system, and am wondering if shucking is pretty easy or not... Does anybody have experience with OMV on this kind of setup? It made me curious.
- mattwad 5y agoNot all drives are "shuckable". But this is pretty common, you see people posting shuckable drives on Reddit often when there's a good sale.
- uhhyeahdude 5y agoThis is why I just let the NSA do my backup management for me.
- coolspot 5y agoEasy to recover the backup using a FOIA request too!
- orf 5y ago> The researchers said Western Digital never responded to their reports. > The communication that came our way confirmed the research team involved planned to release details of the vulnerability and asked us to contact them with any questions,” Western Digital said. “We didn’t have any questions so we didn’t respond.” Lol. Is this entire company, from the developers to the people in charge of comms, complete idiots? I guess this is what you get when you think software is nothing but a cost center then gut + outsource it.
- x3n0ph3n3 5y agoHaving worked there -- mostly. I engaged in multiple arguments with leadership whom wanted to measure engineer productivity based on lines of code added to version control.
- ausumm 5y agohttps://ausum.io/s/Wmp0rFH51RY2PtYe8O7pEYc_czwFLIqcxCHFuwWKsHc https://ausum.io/s/Wmp0rFH51RY2PtYe8O7pEYc_czwFLIqcxCHFuwWKs... Summarized this article into short-form audio for anyone that wants to "read" on-the-go.
- tempfs 5y agoHow many times do people need to be burned by closed-source, cloud boxes before they learn to stop buying them? Western Digital deserves their fair share of blame here as always but honestly the pattern of failure and consequences here is pretty well established by now. Rolling your own remote access solution(SSH/VPN+ strict FW rules) that can be used in conjunction with your own DIY raspberry pi network share(SMB+external drive USB or docked HDD) service is just really well documented in so many articles and is very maintenance free once you cronjob the updates. It is time to own your digital destiny people. The stakes have always been high enough to justify the time and effort. Just do it!
- williamtwild 5y agoNo way mom and pop are going to know how to do this. Even semi tech literate people will struggle.
- gtm1260 5y agoI think your over-estimating how little most people think/care about their storage drives.
- foobar33333 5y agoWhich is why google drive or the ms version is the real solution for most people. Zero effort, low cost, automatically backed up, and has a huge security team keeping your data safe.
- ocdtrekkie 5y agoSo, for those who don't know: Your MyCloud will spam you six times a day about firmware updates if you didn't update. They replaced the vulnerable OS back in March. So people probably should know/have done this by now. It's hardly a zero-day at this point: It was fixed months ago. Second, and I feel like this should be obvious: People should not be exposing their NAS appliance directly to the Internet! Stop doing it. Just don't. If you do, you deserve what you get, because you intentionally went into your consumer-grade firewall and poked a hole in it.
- MrStonedOne 5y ago> They replaced the vulnerable OS back in March. When a full rewrite that removed functionality, so some users aren't going to bother to update, and as far as I'm concerned, thats on WD, not the users.
- ocdtrekkie 5y agoIt's still not a zero day: Fixed software has been available for months. And it's free.
- markzzerella 5y agoFor some hardware. For everybody else, WD says to buy new hardware.
- GekkePrutser 5y agoAre you sure it's always intentional? There might be some UPnP thing going on here.
- ocdtrekkie 5y agoPossible, though we should shame any routers that still allow uPnP. The horror. And MyCloud does default to local only communication.
- DiabloD3 5y ago
- jms55 5y agoThe main thing that struck me about this, is that they only supported their NAS for 5 years? It's a NAS, wouldn't the expectation be that people are running this for 10-15 years?
- gentleman11 5y ago> We strongly encourage moving to the My Cloud OS5 firmware,” the statement reads. “If your device is not eligible for upgrade to My Cloud OS 5, we recommend that you upgrade to one of our other My Cloud offerings that support My Cloud OS 5. Not sure how this isn’t illegal. You sell something so defective that it destroys the thing it’s designed to protect and you refuse to fix it, and rather use it as a chance to force customers to buy new devices that are likely just as bad
- minikites 5y ago>Not sure how this isn’t illegal. Many people believe that regulations on companies stifles innovation, so this is what we get. Apparently, it's your own fault if you bought a defective product.
- colecut 5y agoWhile no regulation is bad, regulation is often bad or worse. Hard to know where to point a finger.
- ErikVandeWater 5y agoQuantity of regulation is not the issue. It's the quality of the existing tens of thousands of pages.
- thijsvandien 5y agoPeople screwed by this are surely going to buy more WD. /s
- KeepFlying 5y agoSadly they probably will. At least the ones who didn't have their shit totally deleted. So many "average" users just want consistency and will go with WD again because they don't need to relearn as much (even if the relearning is minimal it's still a mental barrier for anyone who does not feel totally technically competent). I think of my parents who, despite being very smart people, are frustrated by tech because it doesn't come easy to them. Any extra step isn't beneficial, it's stressful.
- sschueller 5y agoOn the other side I would like to thank synology for 10 years of updates that always worked. This is the way it should be and why I recommend them.
- freeone3000 5y agoWe may be using different Synology products. Updates frequently break filesharing or drive sharing or encryption for me.
- dukeofdoom 5y agoI've never had any problems with external WD drives on mac. However, my Seagate 4Tb is almost unusable. It corrupts my final cut file every time I'm editing off of it. It will randomly disconnect, such that its still mounted under /Volumes/ but its not actually there. Not sure if its overheating. So wanted to go back to WD, but not sure now.
- N00bN00b 5y agoIt's not just WD NAS that are facing issues like this. I have a QNAP, so I follow news on that and they've been getting hit repeatedly with ransomware cryptolockers recently as well. It's nearly always UPNP that's causing the device to be exposed unknowingly to the internet and then a some software bug that allows the exploit.
- ernsheong 5y agoThe share price seems to hold up pretty well despite these revelations.
- defanor 5y agoA more precise (perhaps less clickbaity) title would mention "Western Digital MyCloud users". I thought of their HDDs first, not some of the related products they push (which one shouldn't expect to be secure anyway: being network-connected [black?]boxes, aiming non-tech-savvy users, by a company not specializing on that). To rant a bit more about the title, I find it rather awkward (as a non-native speaker though) when an adjective that is commonly used with a noun becomes used as a noun, and instead of that noun: as "runtime error" in some contexts is replaced with just "runtime", or "0-day vulnerability" is commonly replaced with "0-day" (even when it's not that anymore). This practice seems to just create more confusion.
- fuzzfactor 5y agoIOUT Internet of Unsuitable Things.