Slashdot Mirror

← Back to Stories (view on slashdot.org)

Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor (betanews.com)

Posted by BeauHD on from the public-service-announcement dept.

BrianFagioli shares a report from BetaNews: Today, yet another security blunder becomes publicized, and it is really bad. You see, many Western Digital MyCloud NAS drives have a hardcoded backdoor, meaning anyone can access them -- your files are at risk. It isn't even hard to take advantage of it -- the username is "mydlinkBRionyg" and the password is "abc12345cba" (without quotes). To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. GulfTech Research and Development explains, "The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as 'wdmycloud' and 'wdmycloudmirror' etc." The My Cloud Storage devices affected by this backdoor include: MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100. Firmware 2.30.172 reportedly fixes the bug, so make sure your device is updated before reconnecting to the internet.

17 of 160 comments (clear)

  1. predictable default hostnames by perpenso · · Score: 3, Funny

    ... using one of the many predictable default hostnames ...

    Good thing I renamed mine to "FutureCorruptedBackup" ;-)

  2. 2018 by santax · · Score: 3, Informative

    How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!

    1. Re:2018 by quantaman · · Score: 5, Insightful

      How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!

      It's a massive screwup, though we don't really know how it got there yet, a few quick scenarios are:
      1) It could have been a deliberate backdoor for WD, the government, etc, that was sanctioned by the highest levels of the company, but this seems quite unlikely.
      2) It could be a malicious employee (or even outside attacker) who introduced the backdoor for their own purposes.
      3) An individual or team who didn't know any better put it there.
      4) An individual or team added it for testing purposes, and people forget and never pulled it out.

      My money would be on 3 or 4, reading the advisory from the security researcher it sounds like there was a lot of sloppiness in the WD code.

      It sounds like it was inherited from another WD product that got patched in 2014 (but the patch was never ported to this device) so my money is on crappy software processes.

      --
      I stole this Sig
    2. Re:2018 by bill_mcgonigle · · Score: 4, Insightful

      They probably didn't construct it - a low-bidder did.

      "Brian" Y.G. reused the same code he did for the D-Link job, if one had to venture a guess.

      That tells you something about WD's quality.

      That they found out about this six months ago tells you something about their responsibility. It's actions like these that make class action attorneys drool while they mumble "willful negligence". It's cheaper to fix the code, IMO.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    3. Re:2018 by Anonymous Coward · · Score: 3, Informative

      I'll tell you exactly how it got there: firmware and software development for consumer garbage like this is outsourced to the deepest, darkest bowels of China and India. The code is copied and pasted from the last project, or open source stuff is smashed together until it basically works and they ship it. In this particular case, maybe it was a convenience during development, or maybe there was an organized plan to take advantage of dumb (American) consumers who would never know any better.

      Welcome to the future of embedded software development. Unless there is some way to make legal liability stick to the companies who are treating it like unimportant scut work to be sent to the lowest bidder.

    4. Re:2018 by mikael · · Score: 3, Interesting

      Look at the string "dlink". I had a laptop (Sony Viao) that would spontaneously connect to a DLink router somewhere elsewhere in our neighborhood. By spontaneously connect, I mean wi-fi was disabled by the Linux GUI options, only to see the laptop connect spontaneously to a DLink router. Because the case of the laptop was used as the wi-fi antennae, it had 100 meters range.

      --
      Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
    5. Re:2018 by geekmux · · Score: 3, Insightful

      How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!

      Western Digital knows you opinion represents less than 1% of their current customer base. You mean less to them than the corporate coffee clerk being accused of sexual assault, which means they're not going to think twice about re-installing backdoors into their products if it provides them even the slightest benefit.

      Consumers simply don't give a shit. Firmware update a storage device? That will never happen across 90% of deployed product unless Western Digital does it themselves in a fully automated manner.

    6. Re:2018 by swb · · Score: 3, Interesting

      I think this is the best answer. I doubt "Western Digital" had much to do with the actual software development. They probably had some web designer approve the user interface look and feel for compliance to their design standards and the rest was done who knows where.

      The downside to open source software seems to be the ease at which it allows multinationals to buy the cheapest software possible without actually having to invest much at all in software development, all they need is someplace minimally competent to glue together a bunch of open source components.

  3. Re:"Hardcoded"? by Jake+Griffin · · Score: 4, Insightful

    ...it was disclosed to Western Digital six months ago and the company did nothing.

    Firmware 2.30.172 reportedly fixes the bug...

    Also, I don't think releasing a firmware update is doing nothing.

    --
    SIG FAULT: Post index out of bounds.
  4. Re:WD did nothing! by Jake+Griffin · · Score: 4, Insightful
    Just read TFA... the summary cut off a critical piece of information. TFA states:

    ... the company apparently did nothing until November 2017.

    --
    SIG FAULT: Post index out of bounds.
  5. I tried this ... by CaptainDork · · Score: 3, Interesting

    ... on my "WD Mycloud" wireless device that I purchased last year.

    When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."

    I checked the firmware version and it does have the latest (2.30.172).

    I do not allow access from outside the local LAN and I have to log in as Admin and enable "Share" in order to map a drive.

    I leave Share activated only during the short period of time that it takes to copy files to/from the divice and then I disable Share again.

    I'm hoping that "offline" condition protects me from intruders.

    --
    It little behooves the best of us to comment on the rest of us.
    1. Re: I tried this ... by LordKronos · · Score: 4, Insightful

      When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."

      Please tell me their "fix" wasn't a JavaScript block to prevent you from entering the password for that user.

  6. Jagger said it best by alvinrod · · Score: 3, Funny

    Jagger said it best: "Hey! You! Get off of my cloud!"

  7. Re:"Hardcoded"? by fisted · · Score: 3

    "Bug"? Yeah, me neither.

    As for "hardcoded", I don't think the word means what you think it means.

    --
    CLI paste? paste.pr0.tips!
  8. Re:12345? by Ackmo · · Score: 5, Funny

    Tha movie you're referencing came out 31 years ago. Your age is showing.

    I'm shocked - shocked! - to find that old movie references are going on in here!

  9. joke product, there isn't even a shutdown option by itsme1234 · · Score: 3, Interesting

    I wonder what people are expecting. They aren't treating this seriously, at least on My Cloud Gen 2 (current) there isn't even an option to cleanly shutdown or unmount or mount read-only the main volume. Not even if you enable ssh access (which they warn you not too, for good reason as it is OpenSSH_5.0p1, probably close to 10 years old).

    This is not something you don't catch at testing, not something you design later. Anybody who used a computer since windows 95 and has some working neurons will think "hm, I'm supposed to do some tests or write some documentation on this box I have here but now that I'm done how to shut it down. Pull the plug? Nah, can't be.". They probably asked and the well practiced answer from the (inaptly called) Engineering was "just pull the plug on that 8TB ext4 volume, what can go wrong?".

  10. Re:"Hardcoded"? by sjames · · Score: 3, Insightful

    Hard coded means written into the software as opposed to being user configurable. So the author is correct and you were wrong.

    Hardcoded is why it takes a firmware update to change it rather than go to setup page x and uncheck the box next to "big security hole".