11 ms·
Hackers claim vast access to Western Digital systems
- andrejguran 4y agoseems like their cloud is back online after 5 days: https://status.mycloud.com/os4 https://status.mycloud.com/os4 Wonder if they paid the ransom
- xyst 4y agoOr restored to a backup?
- thricegreat 4y agothe article states they have not run any ransomware on the systems as of yet and they have maintained access. a backup wouldn't do much in this situation. it's not confirmed if the attackers are the cause of the service going offline and it should be presumed if they were they can take it down again.
- JohnMakin 4y agoarticle mentions them "spidering into an azure tenant." Wonder if that's related to the azure multi tenancy misconfiguration that resulted in the Bing CMS being accessed that was brought up a few times here recently: https://news.ycombinator.com/item?id=35363205 https://news.ycombinator.com/item?id=35363205
- steffanA 4y agoVery common to get access to the Azure/Local AD in ransomware attacks. That Bing CMS bug was only exploited by the researchers who disclosed it to MS.
- JohnMakin 4y agoI'm not saying it's literally the same attack, but the author of that Bing CMS bug identified the cause (misconfigured multi tenancy) and said up to 25% of Azure apps they scanned had this same vulnerability.
- readyplayernull 4y agoIs OpenAI at risk with MS deal?
- matthew9219 4y agoFwiw, the finder here is not completely correct in their assertions. Locking the Bing CMS down to single tenancy would have meant that instead of the whole world having access, only about 180,000 Microsoft employees would have access. The actual number of people who should have access is about 50. Maybe 500 the way Bing is bloated. The problem here is that Bing CMS didn't implement the authorization half of authentication and authorization - they simply allowed all authenticated users to access all data. Multi-tenancy expands the scope, but it's not really clear what portion of the 25% of apps the finder surveyed that were multi-tenant similarly lack any authorization whatsoever.
- tpmx 4y agoAssuming the self-proclaimed vermin is operating from $mostly_defunct_state without risk of recourse, what would the arguments be against removing all internet routes to/from $mostly_defunct_state? (Yes, it's obvious that criminals can find ways out of that, please go deeper than that.) Edit: Seems like the downvotes made me hit my rate limit of HN comments. Can't reply to any more comments; sorry. :(
- justeleblanc 4y agoSo what, fuck the people living there? And who are you to decide that some state is "mostly defunct"?
- hackinthebochs 4y agoThey have their own internal internet. Accessing Google and Youtube aren't critical to modern life.
- justeleblanc 4y agoNeither are western digital services.
- f6v 4y agoThat’s like saying you should build a wall around ghettos. Would make for an interesting movie, though.
- neoromantique 4y agoInternet being global and free brings peace and understanding to the world, using it as a weapon is to accept defeat to the totalitarian regimes of yesteryear. Let the $mostly_defunct_state die off with the rest of them without succumbing to their playbook.
- tpmx 4y ago> Internet being global and free brings peace and understanding to the world Do you think that worked with China?
- voytec 4y agorelated thread from few days ago: Western Digital cloud services down for 4 days[1] [1] https://news.ycombinator.com/item?id=35478007 https://news.ycombinator.com/item?id=35478007
- qwertox 4y agoWhat do they mean by "customer data"? Payment information and other PII, or real backup data from this cloud backup thing they have? I only know of this "My Cloud" service which appears to be somehow linked to some NAS-like HDD offerings they have. I never really read about it because it is irrelevant to me, so I don't know if they also mirror the data in the cloud, or if the cloud gives the attacker remote access to these NAS disks and that they exfiltrated data this way, or something else.
- bot999top 4y agoLet's speculate! Probably a lot based on the 10 terabyte number... and the SAP Backoffice... and that it took 5 days for them to come back up Ah, the SAP Backoffice, the magical land where businesses store their most treasured data, and where hackers drool over the potential loot. The SAP Backoffice system is a complex beast, made up of several components, such as: ERP (Enterprise Resource Planning) - The backbone of the operation, keeping track of everything from finances to supply chain management. CRM (Customer Relationship Management) - The digital black book of customer interactions, preferences, and sales opportunities. SRM (Supplier Relationship Management) - The hub that orchestrates the delicate dance between a business and its suppliers. HCM (Human Capital Management) - The watchful eye over the company's most valuable asset: its people. PLM (Product Lifecycle Management) - The puppet master pulling the strings of a product's journey from inception to obsolescence. SCM (Supply Chain Management) - The maestro conducting the symphony of goods flowing from supplier to customer. BI (Business Intelligence) - The all-knowing oracle that uncovers hidden insights from the vast sea of data.
- dabluecaboose 4y agoThe MyCloud hardware line allows you to setup a NAS and optionally expose it to the internet through their online credential service so that you can access the files from anywhere. The data is not "in the cloud" per se, but the credentials and login portal are.
- Apocryphon 4y agoI'm curious if Western Digital's cloud was built upon their acquisition of Bertrand Serlet's startup UpThere at all.
- stan_kirdey 4y agoDo hackers ask for ransom as a single payment, or there is more of a scalable repeatable business model with recurring revenue? A subscription service seems convenient.
- c7DJTLrn 4y ago20% off for the yearly plan, or buy one get one free on Black Friday.
- henriquez 4y agoThe hackers offer a lifetime licensing model for their ExtortionPro SaaS service. With a single convenient payment you can be guaranteed that your enterprise security and confidential information is in good hands. At least until the hacking group is acquired and they reposition their offering as a two year subscription.
- WakoMan12 4y ago[dead]
- boredumb 4y agoIf they can incorporate an LLM somewhere - they may even show up on the front page as a (YC 2024) project.
- eastbound 4y agoI like that you’re discussing revenue streams. They also add social proof on the pricing page (“We blackmailed hospital xyz with success”) and play dopamine effects (“Play PasswordGuessr to unlock a file, or pay to unlock all files”). The infinite scroll is coming to show what your API keys have access to (highly addictive, look at all those bank transactions and, mmh, revenge pics with your ex).
- anonsec123 4y agoWestern Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware.
- nobody9999 4y ago>Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware. What evidence do you have for this? Not being snarky, as I have a whole bunch of WD drives. Please do tell. Thanks!
- DANmode 4y agoHave you used their software?
- djbusby 4y agoCrappy don't necessarily mean security-compromised
- DANmode 4y agoBut it is a smell.
- nobody9999 4y agoNo. I always format every hard drive I buy, but GP asserted that their firmware has likely been compromised for years. That's a strong statement, unsupported by, well, anything. Not saying it isn't true -- and if it is, I want to know about it -- as it puts my systems at risk.
- rasz 4y ago2015 https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-self-encrypting-hard-drives-easily-hacked/ https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-se... 2017 https://www.bleepingcomputer.com/news/security/owners-of-wdtv-media-players-advised-to-take-devices-offline-due-to-security-bugs/ https://www.bleepingcomputer.com/news/security/owners-of-wdt... 2017 https://blog.exploitee.rs/2017/hacking_wd_mycloud/ https://blog.exploitee.rs/2017/hacking_wd_mycloud/ 2018 https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_backdoor/ https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_back... https://www.bitdefender.com/blog/hotforsecurity/researcher-finds-hardcoded-backdoor-in-western-digital-storage-devices/ https://www.bitdefender.com/blog/hotforsecurity/researcher-f... https://www.techpowerup.com/240306/western-digital-ships-someones-backdoor-with-my-cloud-drives https://www.techpowerup.com/240306/western-digital-ships-som... "However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue."
- anigbrowl 4y agoI bought an external drive of theirs a few years ago and they were so into selling me the cloud storage on the back of it. I'm glad that I'm old-fashioned enough to have most stuff stored locally on my mediocre home-build systems rather than the super-duper high performance cloud servers in a data center somewhere. What mystifies me about ransomware attacks is how many targets don't notice that vast quantities of data are being systematically exfiltrated. I can see how it might be particularly difficult for a cloud provider (assuming the hackers didn't pull it all through a single set of credentials), but for many targets, any sort of unfamiliar outgoing data stream larger than a gigabyte ought to be suspicious.
- outworlder 4y ago> I can see how it might be particularly difficult for a cloud provider It is really not, though. Unless they take it very slowly and to locations that are not suspicious. Even something like GuardDuty on AWS will flag 'interesting' traffic to new locations.
- Zuiii 4y agoI know we already have open source IDS/IPS systems, but do we have something like GuardDuty we can run locally that would detect unusually large outbound traffic over a specific timeframe?
- jacquesm 4y ago> What mystifies me about ransomware attacks is how many targets don't notice that vast quantities of data are being systematically exfiltrated. They are not necessarily so. Plenty of times the hackers just pretend they have a copy when in fact they don't. Also encryption 'in place' or overwriting data with noise doesn't do much other than a bunch of IO without any network traffic besides the initial commands.
- anigbrowl 4y agoOK, but in some cases they definitely do have a copy and the amount of data involved is large. It's those cases I'm perplexed by.
- mardifoufs 4y ago>"Cut the crap, get the money, and let’s both go our separate ways. Simply put, let us put our egos aside and work to find a resolution to this chaotic scenario,” the hackers wrote. This weirdly hilarious. Though I wonder how could you even handle such a negotiation, from WD's side?
- neodymiumphish 4y agoYeah, this is difficult. They'll probably have to settle this somehow. Otherwise, Alphv's likely going to work with some sources to create some sort of site to sell each users' content individually, assuming the exfiltrated data includes customer data. Still highly likely that they'd be able to talk this rate down to something well below the 8 figures they're demanding.
- paraxion 4y agoCan anyone let me know whether the 10-terabyte number is 1024-base or 1000-base? Would it fit on the formatted capacity of a Western Digital WD101FZBX Black, for example...?
- Zuiii 4y agoThe rule here is read these numbers in whatever way benefits the manufacturer; i.e read it as base-1024 if bigger numbers look better and 1000 if they don't. I would assume that 10TB of hacked data will not fit a 10TB Western Digital hard drive.
- deleted 4y ago[deleted]
- charlie0 4y agoI've been asking myself, why waste time setting up a NAS when there are cloud based alternatives for storing data. Then, news like this comes along and reminds me why.