3 ms·

Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware.

nobody9999 3y ago
>Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware. What evidence do you have for this? Not being snarky, as I have a whole bunch of WD drives. Please do tell. Thanks!
- DANmode 3y ago
  Have you used their software?
  - djbusby 3y ago
    Crappy don't necessarily mean security-compromised
    - DANmode 3y ago
      But it is a smell.
  - nobody9999 3y ago
    No. I always format every hard drive I buy, but GP asserted that their firmware has likely been compromised for years. That's a strong statement, unsupported by, well, anything. Not saying it isn't true -- and if it is, I want to know about it -- as it puts my systems at risk.
- rasz 3y ago
  2015 https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-self-encrypting-hard-drives-easily-hacked/ https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-se... 2017 https://www.bleepingcomputer.com/news/security/owners-of-wdtv-media-players-advised-to-take-devices-offline-due-to-security-bugs/ https://www.bleepingcomputer.com/news/security/owners-of-wdt... 2017 https://blog.exploitee.rs/2017/hacking_wd_mycloud/ https://blog.exploitee.rs/2017/hacking_wd_mycloud/ 2018 https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_backdoor/ https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_back... https://www.bitdefender.com/blog/hotforsecurity/researcher-finds-hardcoded-backdoor-in-western-digital-storage-devices/ https://www.bitdefender.com/blog/hotforsecurity/researcher-f... https://www.techpowerup.com/240306/western-digital-ships-someones-backdoor-with-my-cloud-drives https://www.techpowerup.com/240306/western-digital-ships-som... "However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue."
  - nobody9999 3y ago
    Thanks! That's not very flattering, and if I used any of those products/software features (I have only bare, internal SAS drives, both spinning rust and SSD) I'd be really concerned. Since I only use bare internal drives, I imagine I'm not at risk (although, I've had one or more of these drives for at least 7 or 8 years -- so if I was at risk, you'd think that would have happened already) from the vulnerabilities noted in the links you provided. But I'll do some research (although I do try to keep track of such things and never heard anything about actual drive firmware -- rather than the NAS/cloud products -- being compromised.) anyway. Thanks again for compiling these links and sharing them. Much appreciated!

nobody9999 3y ago

>Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware. What evidence do you have for this? Not being snarky, as I have a whole bunch of WD drives. Please do tell. Thanks!

DANmode 3y ago
Have you used their software?
- djbusby 3y ago
  Crappy don't necessarily mean security-compromised
  - DANmode 3y ago
    But it is a smell.
- nobody9999 3y ago
  No. I always format every hard drive I buy, but GP asserted that their firmware has likely been compromised for years. That's a strong statement, unsupported by, well, anything. Not saying it isn't true -- and if it is, I want to know about it -- as it puts my systems at risk.
rasz 3y ago
2015 https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-self-encrypting-hard-drives-easily-hacked/ https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-se... 2017 https://www.bleepingcomputer.com/news/security/owners-of-wdtv-media-players-advised-to-take-devices-offline-due-to-security-bugs/ https://www.bleepingcomputer.com/news/security/owners-of-wdt... 2017 https://blog.exploitee.rs/2017/hacking_wd_mycloud/ https://blog.exploitee.rs/2017/hacking_wd_mycloud/ 2018 https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_backdoor/ https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_back... https://www.bitdefender.com/blog/hotforsecurity/researcher-finds-hardcoded-backdoor-in-western-digital-storage-devices/ https://www.bitdefender.com/blog/hotforsecurity/researcher-f... https://www.techpowerup.com/240306/western-digital-ships-someones-backdoor-with-my-cloud-drives https://www.techpowerup.com/240306/western-digital-ships-som... "However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue."
- nobody9999 3y ago
  Thanks! That's not very flattering, and if I used any of those products/software features (I have only bare, internal SAS drives, both spinning rust and SSD) I'd be really concerned. Since I only use bare internal drives, I imagine I'm not at risk (although, I've had one or more of these drives for at least 7 or 8 years -- so if I was at risk, you'd think that would have happened already) from the vulnerabilities noted in the links you provided. But I'll do some research (although I do try to keep track of such things and never heard anything about actual drive firmware -- rather than the NAS/cloud products -- being compromised.) anyway. Thanks again for compiling these links and sharing them. Much appreciated!