Slashdot Mirror
'I'm Admin. You're Admin. Everyone is Admin.' Remote Access Bug Turns Western Digital My Cloud Into Everyone's Cloud (theregister.co.uk)
Researchers at infosec shop Securify revealed this week a vulnerability, designated CVE-2018-17153, which allows an unauthenticated attacker with network access to the device to bypass password checks and login with admin privileges. From a report:This would, in turn, give the attacker full control over the NAS device, including the ability to view and copy all stored data as well as overwrite and erase contents. If the box is accessible from the public internet, it could be remotely pwned, it appears. Alternatively, malware on a PC on the local network could search for and find a vulnerable My Cloud machine, and compromise it. According to Securify, the flaw itself lies in the way My Cloud creates admin sessions that are attached to an IP address. When an attacker sends a command to the device's web interface, as an HTTP CGI request, they can also include the cookie username=admin -- which unlocks admin access. Thus if properly constructed, the request would establish an admin login session to the device without ever asking for a password. In other words, just tell it you're the admin user in the cookie, and you're in. The researcher told TechCrunch that he reported the vulnerability to Western Digital last year, but the company "stopped responding."
"Hey, you, get off of my cloud."
this is a feature not a bug, quit bugging us
WD bug Support Team
Well I am Admin, you are Admin, she is Ad-min too! I am Admin, he is Admin, ooont I believe that you are Admin too!
First up--
There are at least 3 kinds of MyCloud out there, not counting the multi-bay devices, which are probably likewise vunerable-- stay with me.
First are the two generations of mycloud "personal cloud" devices. The last is the "Mycloud Home" device, which is more of a personal media server than an actual NAS. Of the first two, the generation 1 is possibly fixable by the end user easily. It uses a REAL root file system on persistent storage, meaning you can go in and make changes to the web UI and pals if you want to. The second generation, however, is a real bitch. I will wax philosophical on this latter model, as the multi-bay devices (EX2, EX2 ultra, and pals) are likewise afflicted, and based on the same codebase. In fact, you can poke at a system identification value, and enable features on the single bay units that are selling points on the more expensive dual bay versions, because they run the exact same software.
The gen 2 MyCloud uses an initial ramdisk backed root file system, into which a cramfs container is mounted by the init script. The web UI and pals are hosted by this cramfs container, so unless you want to bake a brand new container to fix the CVE, you are boned.
Also, the single bay mycloud units are now End of Life, as WD is no longer making them. They have switched whole hog to the MyCloud Home device, which is not a NAS appliance at all.
Now, why I really dont give a flying rat's ass about the CVE:
The MyCloud units DO NOT perform any signature checking against the kernel and ramdisk that the bootloader starts.
SO-- You can TOTALLY replace that epic clusterfuck WD put on it, and replace it with a completely sane and sanitary minimalist debian installation, which lacks a web GUI to attack in the first place.
Gen2 (and similar units) use uBoot. There are lots of good tools for making uBoot images and ramdisks. This system is easily made full-custom.
Hey. Your friendly neighbour hacker here. I've noticed that you have terrible taste when it comes to porn so I've uploaded a few gig of some good stuff to your drive. You're welcome.
...if it's too important to risk being ransom-wared, doxed, or generally abused in some way. If you must share files on a network with colleagues/friends/family, do it properly with a server, appropriate software, and hardened security.
Debate is a form of harassment. Do not question my truth.
The last time they were told of a trivial exploit like this they ignored it for 6 months.
Clearly Western Digital doesn't care whatsoever about security. (That vulnerability is also mentioned at the end of the article.)
... large scale n00bie-style f*ckups by professional companies in the data-security field absolutely bedazzling. Isn't something of this type gross neglect or something and can't they be sued into next wednesday for it?
This is un-fucking-believable.
We suffer more in our imagination than in reality. - Seneca
Not at all surprising, to me. I had a couple Western Digital Drives years ago, two out of two failed under careful, gentle use, and I have not bought a Western Digital ANYTHING since. I do not fell like I can trust them, and this is just another example, (to me,) of why no one SHOULD.
It hardly matters what type of electronic device I'm looking at: The hardware usually seems fine, but the software is a shoddy mess so often that I have to ask: Why? A cookie that just tells the device that you're admin is a rookie mistake. Whoever wrote that software is a fraud. Western Digital isn't a small mom&pop shop or a fly-by-night outfit. Why are they (and so many other companies) not capable of writing acceptable quality software, but hardware does not seem to have this problem?
When will computers be subject to mandatory recalls when they have bugs that effectively prevent them from being used "as designed" or "as marketed?"
Manufacturers would have a choice: Fix the problem or refund the purchase price.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
jim carrey, penis fairy?
Wouldn't it be nice if we lived in a world where this was not a problem? Why can't we trust people to be honorable, if you can see files why are we compelled to take them and open them, knowing they do not belong to us? Humanity is perpetually doomed.
My DL4100 NAS died this past weekend. Just the controller. Array, drives, data all fine. Controller just died 3mo after warranty ended. Luckily it used a standard container for the RAID5 set, and EXT4 so I was able to hook all 4 drives up to a system and drag the data off.
Synology DS918+ now.
... and I don't allow remote access.
I have the shares disabled, as well.
I'm a photographer with gigabytes of photos and I store them in multiple locations, including this NAS.
Every now and then I log in through my WiFi and enable Share to copy new stuff to it.
Then I disable all Shares.
It little behooves the best of us to comment on the rest of us.
'm Admin Dave. You're Admin Dave. Everyone is Admin Dave.'
WD has had this vulnerability for a while. Thing is: how can they expect to hire ANYONE by advertising how stupid they are? This is like the most dumbass vulnerability. While you can firewall the thing, a malicious site can http-redirect you to your OWN appliance by guessing the private IP and mess with it via URL. Chalk it up to the benefits of outsourcing, I suppose.
...entirely at your own risk...WD not liable for anything...
It goes downhill from there. Welcome to the world.
... a feature we paid for.
Signed,
The NSA
Though the manufacturing companies are pandering to the lazy users. The proper way to access a device on your LAN from the Internet is to set up your router with a VPN server. When you're away from home, you connect to your home router via the VPN. That'll give you access to your NAS, your security cameras, your media library, etc. while you're away from home.
But users are too lazy to bother to set up a VPN server (even though many routers now come with one built-in) and manage a dynamic DNS domain name. So manufacturers pander to them by setting up each individual device to be accessible from the cloud. Usually by having the device contact a server via the manufacturer's website, which acts as a go-between for the handshaking between the cloud device when you try to access it from the Internet. That is, the device handles the VPN-like encryption and their server handles tracking your LAN's public IP address (equivalent to dynamic DNS).
By itself this isn't any worse than using a VPN. But multiply it by a half dozen cloud devices, and the chances that every single one of those devices is secure is substantially lower than the chance that your VPN server is secure.
Synology and QNAP have their issues, but one thing I am reasonably assured of with the Synology NAS models I have is decent security. It is very easy to use the onboard firewall, they have logging and reporting, onboard encryption for data (so if the drives or unit is taken, the data is protected), a backup utility to save data to an external drive, another NAS, or a cloud provider (with the option for clientside encryption.)
On the cheap, I can buy a discontinued, new Synology 115j for $50 or so. Even this model with its slow ARM CPU can handle Samba, backups, even iSCSI if one is that insanely inclined. Of course, it is wise to buy a two drive NAS for RAID, but the cost for a low end model makes it viable to buy a discounted, external USB drive, pull the HDD out of the enclosure, and put it in the NAS, and have a lot more features, including "cloud" access, and backups.
How's life in the hypocrite lane?
If I didn't know better, I might come to the conclusion that storing sensitive data on someone else's hard drive, at random, was a risk and a bad idea.
Western digital is amusing. They sabotage their own products and expect people to keep buying anyway.
Vuln itself is inexcusable.
Response is criminal negligence.
We used to buy performance 2.5" (black) spinning platters from WD .. These shit things are still parking themselves to death in a matter of months while tools to stop the insanity no longer work.
There is something seriously wrong with this company.
unF.
I'm sorry Dave, i can't let you do that.
look at Backblaze's yearly round-up of HDDs to get an idea just how bad WD and Seagate's drives are compared to Toshiba, Hitachi, HGST etc.
WD owns Hitachi/HGST...
The web interface was so buggy and lag inducing (not just the GUI but the entire drive), that the device was all but unusable with it enabled.
Eventually got the point that to fix the performance I just disabled apache in the startup files and SSH and manually start it up on the rare occasion that I need to change a setting.
> 'I'm Admin. You're Admin. Everyone is Admin.'
Could we *please* drop this dumb meme and all its variants? It serves no purpose here, and isn't even remotely funny. And those lucky enough to not even know what it's in reference to will have no clue of its origin or what the point of its use is in this context. Especially on a site like this--unless suddenly the /. demographic has changed and now includes day-time TV viewers.