Slashdot Mirror
Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor (betanews.com)
BrianFagioli shares a report from BetaNews: Today, yet another security blunder becomes publicized, and it is really bad. You see, many Western Digital MyCloud NAS drives have a hardcoded backdoor, meaning anyone can access them -- your files are at risk. It isn't even hard to take advantage of it -- the username is "mydlinkBRionyg" and the password is "abc12345cba" (without quotes). To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. GulfTech Research and Development explains, "The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as 'wdmycloud' and 'wdmycloudmirror' etc." The My Cloud Storage devices affected by this backdoor include: MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100. Firmware 2.30.172 reportedly fixes the bug, so make sure your device is updated before reconnecting to the internet.
12345? That's the same combination as my luggage!
...have a hardcoded backdoor, meaning anyone can access them...
Firmware 2.30.172 reportedly fixes the bug...
I don't think that word means what the author thinks it means.
... using one of the many predictable default hostnames ...
Good thing I renamed mine to "FutureCorruptedBackup" ;-)
"To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing." ... "Firmware 2.30.172 reportedly fixes the bug"
hmm...
Whenever I buy a new external drive the first thing I do is repartition it to get rid of whatever shitty software they included and reformat it.
How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!
I gave up on consumer NAS because the permissions suck - you can't integrate with a Windows domain. So these days my 'NAS' is a USB drive shared off my server.
ON the other hand, I'm not 100% certain (because of lack of interest once I had my own solution in place), but I believe many consumer router/modems now come with a USB port to share storage or a printer. I'd suggest investing some time in hunting down a router with that feature instead of going with a consumer NAS device.
On my third hand... I'm not entirely sure if permissions would work under that scenario or if the router would ignore them. Presumably it ends up acting as a gateway and may not support anything other than "Everyone - Full Control". And I've no idea what would happen with Linux or Mac users.
I was a fan of WD for a long time, I even had a couple of their NAS My Book Live drives, which were quite nice for the price and were accessible directly over the LAN, but the new "My Cloud" drives require crappy software to work and require to always be online to work, both deal killers for me. These days I only buy HGST drives (yes, I know WD owns them, but they are still made by a different group).
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
The issue appears to be one of control. Intel wants control of their chips so they put in a secret operating system, amd did the same. John Deer doesn't want farmers to fix their tractors, cars are sold with black boxes unable to be removed or GPS taggers by the dealership they sometimes forget to remove. OnStar can remotely disable your vehicle.
When we pay money for a product the issue of control is supposed to be that we have it, we have the item, we have the control. The idea is supposed to be that the 'free market' takes care of these problems, don't like your tractor from john deer get one from somewhere else, don't like intel or AMD go buy another chip etc. However in reality a core principle of free market is that leaders and monopolies rise or organizations will combine through mergers leaving little viable competition.
How to fix? Well we require access to technologies and blueprints for many of these products in order to replicate/fix/upgrade them which is something frowned upon in north america. It should not be though, we should have a central repository of knowledge that industry leaders or startups can reference for creating these items without having to play legal games and jump through hoops purchasing/leasing patents. We need to open this knowledge up for the public. I want to be able to create my own chips and circuit boards at home, which seems fantastical but I do not believe that it is, it just feels that way because we do not do this now and imagine it requires some sort of super science.
Western digitals backdoor is a symptom of a disease of ownership past the point of purchase which is afflicting north america, weakening us. We need more alternatives, we need a competitive market place, and we need to empower individuals to create.
It's the MyCloud NSA drive
I am shocked—shocked—to find that there is a back door in a "cloud" product.
How about you gettin' faggin'...
From TFA "To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. "
Yet after that they state "Firmware 2.30.172 reportedly fixes the bug."
So they did nothing, but they also fixed the bug in a new release of firmware?
... on my "WD Mycloud" wireless device that I purchased last year.
When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."
I checked the firmware version and it does have the latest (2.30.172).
I do not allow access from outside the local LAN and I have to log in as Admin and enable "Share" in order to map a drive.
I leave Share activated only during the short period of time that it takes to copy files to/from the divice and then I disable Share again.
I'm hoping that "offline" condition protects me from intruders.
It little behooves the best of us to comment on the rest of us.
Jagger said it best: "Hey! You! Get off of my cloud!"
Perhaps "our cloud" would be more apt.
Western Digital did nothing and they also fixed it via firmware. Huh?
Non-issue because the warning used "literally". Next...
Being explicitly cloud mirrored devices, once configured they automatically copy the contents to a 3rd party. And people buy these things.
https://www.youtube.com/watch?v=VIXOOwthtaE
Way to go idiot WD programmers, QA, supervisors, managers, and your whole stupid operation.
Love you hard drives though.
So, let's say you're designing a Linux-based embedded system and you want to be able to make modifications and upgrades to the OS in the field. How do you allow for this without root access? And so what if the root user has a password? If you have to give that to a customer to perform these upgrades, that password is no longer secure.
With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable. Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.
Democrats wanted SO but never use it. Was it just a money grab as people said it was? The answer is : Yes. Another worse law by worthless liberals that costs this country BILLIONS each year. Either repeal S.O. or apply it!
Isn't the reason you bought private storage that you wanted to keep it private?
It said NSA on the label; Dang!
I use mine mostly to load pee videos, hoping I'll get a job in the current administration; you never know...
Truth isn't Truth - Guliani
meaning the password is changed to "abc12345cba1"
Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.
Or intent. All damage done to be paid for by them, triple damages on top and they have to prove it was not their fault to fend that off. Or alternatively, they have to take these back, give a full refund and pay $1000 or 3 times the value for the effort to move the data, whichever is higher. Hard coded passwords are one of the most extreme and most obvious violation of basic security best practices.
As it currently is, absolutely nothing by a bit of bad press will be happening to them and hence they will do nothing.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I had a drive like this, I took it down after it appeared to be making transfers in the middle of the night when all of computing equipment was shut off.
I wonder what people are expecting. They aren't treating this seriously, at least on My Cloud Gen 2 (current) there isn't even an option to cleanly shutdown or unmount or mount read-only the main volume. Not even if you enable ssh access (which they warn you not too, for good reason as it is OpenSSH_5.0p1, probably close to 10 years old).
This is not something you don't catch at testing, not something you design later. Anybody who used a computer since windows 95 and has some working neurons will think "hm, I'm supposed to do some tests or write some documentation on this box I have here but now that I'm done how to shut it down. Pull the plug? Nah, can't be.". They probably asked and the well practiced answer from the (inaptly called) Engineering was "just pull the plug on that 8TB ext4 volume, what can go wrong?".
>> make sure your device is updated before reconnecting to the internet.
What a load of very bad advice.
Trusting a company again with such a shitty record of deliberately exposing their users data, and not even aknowledging and explaining the problem, then correcting silently ???
And the author wants to trust them ??? And he gives advice to people to trust them again ??
Thats irresponsible from the author
Yes, my money is on 3 or 4 too (too obviously stupid for other things, but then... plausible deniability and things, so I would just bet 3/4 of my farm).
But this:
"it was disclosed to Western Digital six months ago and the company did nothing."
should definitely put someone higher up in jail, if it's true. It signals a major failure in corporate culture.
I feel glad to stumble upon this content. i have written a blog on Laravel PHP framework click more to read more http://micrasystems.com/laravel-development-company/
as well, when it comes to their hard drives. Have a look at Backblaze's benchmarks and notice the dramatic difference in lifelength and quality on drives compared to Toshiba and Hitachi/HGST. If you're looking for a new drive, this is just another reason to stay away from WD (and Seagate).
You can live in a shack in the woods like Ted Kaczynski. It only took the FBI two weeks to plant the third typewriter that turned out to "prove" he was the Unibomber, the other two they first found brought out not matches for crazy letters (but just forget about that, youre TOTALLY free to go live alone in the woods bro!).
I am not in the least surprised. This isn't anything malicious, or nefarious. I'm almost certain that this was implemented intentionally for user support purposes.
Users forgot their credentials all the time. If there is no backdoor, all their data is lost. Likely someone ran the risk matrix and determined it was better to have a backdoor that could provide access to users (likely support staff to go in and reset users password), than to have a bunch of angry users losing all their data all the time. Anyone that has worked in IT for any period of time will know that this issue is constant and likely the most numerous reason for support calls.
Further, if you're using a commercial WD Cloud NAS, you aren't holding the nuclear codes or any kind of of industrial secrets in there. At worst, there will be a lot of personal information you might not like out in the wild. Considering a user could presumably also further encrypt their data on said NAS if they really wanted to, if they were really storing something sensitive really puts it back onto the user. I wouldn't be surprised that somewhere buried in the WD cloud EULA all of this is explained and indemnified for WD.
The only thing I find a bit surprising is the half-assed way it was seemingly implemented. "The username is "mydlinkBRionyg" and the password is "abc12345cba"? Really? That is just lazy. They could have at least made the method a bit more difficult or at least came up with a username/password that wasn't something a 8 year old would come up with...
This is a strong argument for PFSense, Smoothwall, or Falcongate
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Have these deliberately crafted backdoors ever had much legitimate use? Bear in mind I'm not talking about devices that go into a special access mode when physical buttons are pressed. (like some printers and copiers IIRC). I understand the reasoning that it gives a simple way for the call centre support folks to gain access to their companies devices so they can reset the machine. But as far as I know, this capability is never given to the call centre staff, not even at the tier 2 or higher levels. And I don't think it can be justified from a pre-release unit testing POV either, since the same function could be provided by switching a jumper, enabling a wire trace or plugging into a serial port inside the device, all methods easy enough to disable when the device goes into full production. (and all require physical access to the device anyway, so the security risk is minimal)
I used to work in a call centre, providing support for a US Internet provider. For DOCSIS 2.0 and higher modems, there are some things the support staff could do remotely, but all of them required knowing the serial # for the device. In most markets, that info was not found in the customers file, we had to ask the customer to read it to us from a label on the bottom or back of the modem. Entering the serial number in a tool we had led to a query against the ISP database and provided the MAC and from there we could perform a subset of functions. Anything major though required it go to depot where a technician could connect to the serial port inside the modem case. I see no reason why the same strategy couldn't be used for routers, printers et al.
I need a wheelchair van for my son. Help me get the word out. https://www.gofundme.com/wheelchair-van-for-jj
... something someone coded for unit testing and forgot to mark as debug only, so it was included in the production build.
If WD or the NSA wanted to deliberately put in a backdoor, even they wouldn't be stupid enough to use that username and password combo. Or, would they?
Facebook has killed critical thinking. :)
Truth isn't Truth - Guliani