Slashdot Mirror
Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor (betanews.com)
BrianFagioli shares a report from BetaNews: Today, yet another security blunder becomes publicized, and it is really bad. You see, many Western Digital MyCloud NAS drives have a hardcoded backdoor, meaning anyone can access them -- your files are at risk. It isn't even hard to take advantage of it -- the username is "mydlinkBRionyg" and the password is "abc12345cba" (without quotes). To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. GulfTech Research and Development explains, "The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as 'wdmycloud' and 'wdmycloudmirror' etc." The My Cloud Storage devices affected by this backdoor include: MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100. Firmware 2.30.172 reportedly fixes the bug, so make sure your device is updated before reconnecting to the internet.
12345? That's the same combination as my luggage!
... using one of the many predictable default hostnames ...
Good thing I renamed mine to "FutureCorruptedBackup" ;-)
"To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing." ... "Firmware 2.30.172 reportedly fixes the bug"
hmm...
Whenever I buy a new external drive the first thing I do is repartition it to get rid of whatever shitty software they included and reformat it.
How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!
I gave up on consumer NAS because the permissions suck - you can't integrate with a Windows domain. So these days my 'NAS' is a USB drive shared off my server.
ON the other hand, I'm not 100% certain (because of lack of interest once I had my own solution in place), but I believe many consumer router/modems now come with a USB port to share storage or a printer. I'd suggest investing some time in hunting down a router with that feature instead of going with a consumer NAS device.
On my third hand... I'm not entirely sure if permissions would work under that scenario or if the router would ignore them. Presumably it ends up acting as a gateway and may not support anything other than "Everyone - Full Control". And I've no idea what would happen with Linux or Mac users.
I was a fan of WD for a long time, I even had a couple of their NAS My Book Live drives, which were quite nice for the price and were accessible directly over the LAN, but the new "My Cloud" drives require crappy software to work and require to always be online to work, both deal killers for me. These days I only buy HGST drives (yes, I know WD owns them, but they are still made by a different group).
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
The issue appears to be one of control. Intel wants control of their chips so they put in a secret operating system, amd did the same. John Deer doesn't want farmers to fix their tractors, cars are sold with black boxes unable to be removed or GPS taggers by the dealership they sometimes forget to remove. OnStar can remotely disable your vehicle.
When we pay money for a product the issue of control is supposed to be that we have it, we have the item, we have the control. The idea is supposed to be that the 'free market' takes care of these problems, don't like your tractor from john deer get one from somewhere else, don't like intel or AMD go buy another chip etc. However in reality a core principle of free market is that leaders and monopolies rise or organizations will combine through mergers leaving little viable competition.
How to fix? Well we require access to technologies and blueprints for many of these products in order to replicate/fix/upgrade them which is something frowned upon in north america. It should not be though, we should have a central repository of knowledge that industry leaders or startups can reference for creating these items without having to play legal games and jump through hoops purchasing/leasing patents. We need to open this knowledge up for the public. I want to be able to create my own chips and circuit boards at home, which seems fantastical but I do not believe that it is, it just feels that way because we do not do this now and imagine it requires some sort of super science.
Western digitals backdoor is a symptom of a disease of ownership past the point of purchase which is afflicting north america, weakening us. We need more alternatives, we need a competitive market place, and we need to empower individuals to create.
...it was disclosed to Western Digital six months ago and the company did nothing.
Firmware 2.30.172 reportedly fixes the bug...
Also, I don't think releasing a firmware update is doing nothing.
SIG FAULT: Post index out of bounds.
Their release notes even state that it resolves "critical security vulnerabilities" - https://community.wd.com/t/2-3...
SIG FAULT: Post index out of bounds.
I am shocked—shocked—to find that there is a back door in a "cloud" product.
... on my "WD Mycloud" wireless device that I purchased last year.
When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."
I checked the firmware version and it does have the latest (2.30.172).
I do not allow access from outside the local LAN and I have to log in as Admin and enable "Share" in order to map a drive.
I leave Share activated only during the short period of time that it takes to copy files to/from the divice and then I disable Share again.
I'm hoping that "offline" condition protects me from intruders.
It little behooves the best of us to comment on the rest of us.
Jagger said it best: "Hey! You! Get off of my cloud!"
Perhaps "our cloud" would be more apt.
"Bug"? Yeah, me neither.
As for "hardcoded", I don't think the word means what you think it means.
CLI paste? paste.pr0.tips!
https://www.youtube.com/watch?v=VIXOOwthtaE
Way to go idiot WD programmers, QA, supervisors, managers, and your whole stupid operation.
Love you hard drives though.
So, let's say you're designing a Linux-based embedded system and you want to be able to make modifications and upgrades to the OS in the field. How do you allow for this without root access? And so what if the root user has a password? If you have to give that to a customer to perform these upgrades, that password is no longer secure.
With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable. Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.
Democrats wanted SO but never use it. Was it just a money grab as people said it was? The answer is : Yes. Another worse law by worthless liberals that costs this country BILLIONS each year. Either repeal S.O. or apply it!
Isn't the reason you bought private storage that you wanted to keep it private?
It said NSA on the label; Dang!
I use mine mostly to load pee videos, hoping I'll get a job in the current administration; you never know...
Truth isn't Truth - Guliani
They did nothing until months later. Why are there a myriad of anonymous posts claiming that WD was quick to fix this? Do we need a Western Digital Employee filter?
Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.
Or intent. All damage done to be paid for by them, triple damages on top and they have to prove it was not their fault to fend that off. Or alternatively, they have to take these back, give a full refund and pay $1000 or 3 times the value for the effort to move the data, whichever is higher. Hard coded passwords are one of the most extreme and most obvious violation of basic security best practices.
As it currently is, absolutely nothing by a bit of bad press will be happening to them and hence they will do nothing.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I had a drive like this, I took it down after it appeared to be making transfers in the middle of the night when all of computing equipment was shut off.
I wonder what people are expecting. They aren't treating this seriously, at least on My Cloud Gen 2 (current) there isn't even an option to cleanly shutdown or unmount or mount read-only the main volume. Not even if you enable ssh access (which they warn you not too, for good reason as it is OpenSSH_5.0p1, probably close to 10 years old).
This is not something you don't catch at testing, not something you design later. Anybody who used a computer since windows 95 and has some working neurons will think "hm, I'm supposed to do some tests or write some documentation on this box I have here but now that I'm done how to shut it down. Pull the plug? Nah, can't be.". They probably asked and the well practiced answer from the (inaptly called) Engineering was "just pull the plug on that 8TB ext4 volume, what can go wrong?".
Hard coded means written into the software as opposed to being user configurable. So the author is correct and you were wrong.
Hardcoded is why it takes a firmware update to change it rather than go to setup page x and uncheck the box next to "big security hole".
I am not in the least surprised. This isn't anything malicious, or nefarious. I'm almost certain that this was implemented intentionally for user support purposes.
Users forgot their credentials all the time. If there is no backdoor, all their data is lost. Likely someone ran the risk matrix and determined it was better to have a backdoor that could provide access to users (likely support staff to go in and reset users password), than to have a bunch of angry users losing all their data all the time. Anyone that has worked in IT for any period of time will know that this issue is constant and likely the most numerous reason for support calls.
Further, if you're using a commercial WD Cloud NAS, you aren't holding the nuclear codes or any kind of of industrial secrets in there. At worst, there will be a lot of personal information you might not like out in the wild. Considering a user could presumably also further encrypt their data on said NAS if they really wanted to, if they were really storing something sensitive really puts it back onto the user. I wouldn't be surprised that somewhere buried in the WD cloud EULA all of this is explained and indemnified for WD.
The only thing I find a bit surprising is the half-assed way it was seemingly implemented. "The username is "mydlinkBRionyg" and the password is "abc12345cba"? Really? That is just lazy. They could have at least made the method a bit more difficult or at least came up with a username/password that wasn't something a 8 year old would come up with...
Well, since dlink patched the same hole (DLINK!) in 2014, yeah this is some shared codebase, and it was reported by security researchers in 2017, they really took their time.
Cheap storage VM.
Who said they were quick to fix it?
But if we have two pieces of information, "They did nothing" and also "it is fixed", then that causes some confusion.
This is a strong argument for PFSense, Smoothwall, or Falcongate
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
yeah, but even backblaze says their prices still make them competitive.
Cheap storage VM.
Have these deliberately crafted backdoors ever had much legitimate use? Bear in mind I'm not talking about devices that go into a special access mode when physical buttons are pressed. (like some printers and copiers IIRC). I understand the reasoning that it gives a simple way for the call centre support folks to gain access to their companies devices so they can reset the machine. But as far as I know, this capability is never given to the call centre staff, not even at the tier 2 or higher levels. And I don't think it can be justified from a pre-release unit testing POV either, since the same function could be provided by switching a jumper, enabling a wire trace or plugging into a serial port inside the device, all methods easy enough to disable when the device goes into full production. (and all require physical access to the device anyway, so the security risk is minimal)
I used to work in a call centre, providing support for a US Internet provider. For DOCSIS 2.0 and higher modems, there are some things the support staff could do remotely, but all of them required knowing the serial # for the device. In most markets, that info was not found in the customers file, we had to ask the customer to read it to us from a label on the bottom or back of the modem. Entering the serial number in a tool we had led to a query against the ISP database and provided the MAC and from there we could perform a subset of functions. Anything major though required it go to depot where a technician could connect to the serial port inside the modem case. I see no reason why the same strategy couldn't be used for routers, printers et al.
I need a wheelchair van for my son. Help me get the word out. https://www.gofundme.com/wheelchair-van-for-jj
Facebook has killed critical thinking. :)
Truth isn't Truth - Guliani
Considering that I own one of these devices, AND I participate frequently on the WD community group for this device, I can confirm that the base package is identical between consumer and midsize business class offerings. I can *ALSO* confirm that we have proposed workable patches on many numerous occasions, in every "Leave feedback" location WD makes available. (Protip, THEY IGNORE US.)
At least on the older Gen1 consumer mycloud units, the web interface and the /etc/passwd file were hosted by a real, writable filesystem that could handle persistent changes, meaning that the information we share in the community pages could be used to correct the security vulnerabilities if you wanted to take the matter into your own hands. Many people did this.
On the Gen2 however, WD decided that the user being able to modify the root file system persistently was just not something they felt comfortable with. It is a ram-backed root file system from an initial ramdisk, into which a cramfs container gets automatically mounted at a defined mount point. The cramfs container contains the web UI, and all the major system binaries. /etc/passwd and pals are all obliterated on every boot, because they live in the initial ramdisk image.
That said, the hardware itself is *NOT* that bad. Just the horror-show WD offers software wise. (STAY THE FUCK AWAY FROM WD-SYNC.) There is a russian frequent contributor to the community site who has created instructions for a "From scratch" pure debian deployment on the Mycloud (both gen1 and gen2) units. This completely replaces the WD software with fully FOSS software, and gives the user full control over the unit.
Many people in the community board are Americans, like myself. We have proposed many solutions and fixes that we have locally implemented and given local testing to. We are not afraid to propose solutions, or to do things ourselves. The problem is that big companies do not feel comfortable testing things (Its a cost center! How horrible!!), and would rather just take a generic canned product, slap their name on it, and run. That is hardly an American thing.
The issue with H1B labor is that H1B software people often tend to do the same thing. They will take the homebrewed things people like myself make, (which have **NOT*** been sufficiently tested to mass deploy!!!!!!), slap their names on them and run with them, and their bosses, doing the same exact thing, are just peachy keen with this.
As for your assertion that we should make our own startups--- Do you have any idea how much the industry is stacked against new blood entering the market? Are you fucking delusional? Do you think that there are no people in the US that are just straight up makers, builders, and engineers who do shit for fun, who would love to make neat products available to people? The major reasons why we dont have many people doing that are two-fold; 1) Our erstwhile government frowns on individual thought and self-empowerment of the citizenry, and actively promotes a narrative that if you see your neighbor making something suspicious, he is probably an islamic terrorist making some kind of improvised explosive to blow your kids up on the bus with, or some crazy shit. The mainstream press eats that shit up like candy because it is over the top, and our culture is conditioned to soak it up like a sponge. There is a damned near moral panic against people doing neat stuff in garages these days. 2) Big corporations dont like new products entering the market, so they lobby to require "You must be this big to play" hurdles thrown in. Now, not only do you need to have a good idea and a working prototype, you need to have your entire product vetted for intellectual property form other vendors, even if you have no idea those vendors even exist, (and in many cases, are simply patent trolls!), which means hiring a small team of lawyers--- You also need investment capital to meet stringent manufacturing and materials use regulations, pay for init