Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Data Storage Security Bug Cloud Privacy The Internet

Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor (betanews.com) 160

BrianFagioli shares a report from BetaNews: Today, yet another security blunder becomes publicized, and it is really bad. You see, many Western Digital MyCloud NAS drives have a hardcoded backdoor, meaning anyone can access them -- your files are at risk. It isn't even hard to take advantage of it -- the username is "mydlinkBRionyg" and the password is "abc12345cba" (without quotes). To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. GulfTech Research and Development explains, "The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as 'wdmycloud' and 'wdmycloudmirror' etc." The My Cloud Storage devices affected by this backdoor include: MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100. Firmware 2.30.172 reportedly fixes the bug, so make sure your device is updated before reconnecting to the internet.

Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor

Comments Filter:
  • by Anonymous Coward
    12345? That's the same combination as my luggage!
  • by perpenso ( 1613749 ) on Monday January 08, 2018 @06:32PM (#55889409)

    ... using one of the many predictable default hostnames ...

    Good thing I renamed mine to "FutureCorruptedBackup" ;-)

  • by Anonymous Coward

    "To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing." ... "Firmware 2.30.172 reportedly fixes the bug"

    hmm...

  • Standard procedure (Score:2, Informative)

    by Anonymous Coward

    Whenever I buy a new external drive the first thing I do is repartition it to get rid of whatever shitty software they included and reformat it.

    • You reformat the firmware too right, just to be sure?
      • You TOTALLY CAN do that on the MyCloud.

        The boot loader looks for an unsigned kernel and initrd on a specific partition, formatted as FAT32, with a specific file name.

        You can bake your own and put it on the drive, and the mycloud will boot that image and initrd without complaints.

        In the community pages, we have been working on a straight up clean debian for quite some time. There are instructions on how to configure and compile your own kernel from the stock device tree.

  • 2018 (Score:3, Informative)

    by santax ( 1541065 ) on Monday January 08, 2018 @06:35PM (#55889429)
    How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!
    • >How can it be possible that a big company like Western Digital constructs a backdoor to your personal data?

      It's not unheard of for companies to do this on consumer devices, for technical support to assist people who lock themselves out of devices and don't want to lose data. Up until now I'd only ever seen it in rebranded modems bundled with DSL service, but for a while it was difficult to avoid.

      I agree it was never a good idea, and nowadays it should be considered criminal.

      • by mikael ( 484 )

        I remember buying a very early laptop which had BIOS password protection. One time I forgot the password, called the store asking how I can reset it. "Oh, you'll have to bring it into the store for our technicians to work on in our workshop. It has to be done there, as we can't let you see the recovery process." So I removed each back panel, found the password reset DIM switch, and reset the password.

    • Re:2018 (Score:5, Insightful)

      by quantaman ( 517394 ) on Monday January 08, 2018 @06:53PM (#55889549)

      How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!

      It's a massive screwup, though we don't really know how it got there yet, a few quick scenarios are:
      1) It could have been a deliberate backdoor for WD, the government, etc, that was sanctioned by the highest levels of the company, but this seems quite unlikely.
      2) It could be a malicious employee (or even outside attacker) who introduced the backdoor for their own purposes.
      3) An individual or team who didn't know any better put it there.
      4) An individual or team added it for testing purposes, and people forget and never pulled it out.

      My money would be on 3 or 4, reading the advisory from the security researcher it sounds like there was a lot of sloppiness in the WD code.

      It sounds like it was inherited from another WD product that got patched in 2014 (but the patch was never ported to this device) so my money is on crappy software processes.

      • by santax ( 1541065 )
        I find 3 and 4 hard to believe. We all know what happened in the 90's when devices were not connected as much, but when this was common practice. GuestA B and C with the same password made my teenage years very exciting. These days, if an engineer does this in a company, I ask who is controlling the proces? Why wasn't the probably highly payed engineer unaware of the commonly know security practices... It's a F* up indeed and in a company the size of WD there probably are strict protocols and testing of dev
        • by Anonymous Coward

          You can bet your ass that the NSA backdoor isn't easy to find like this. If you find incompetence "hard to believe", you've got to be new to Earth.

      • Re: (Score:3, Informative)

        by Anonymous Coward

        I'll tell you exactly how it got there: firmware and software development for consumer garbage like this is outsourced to the deepest, darkest bowels of China and India. The code is copied and pasted from the last project, or open source stuff is smashed together until it basically works and they ship it. In this particular case, maybe it was a convenience during development, or maybe there was an organized plan to take advantage of dumb (American) consumers who would never know any better.

        Welcome to the

        • by Anonymous Coward

          This. It was probably there for testing and they never took it out.

        • Re:2018 (Score:4, Interesting)

          by swb ( 14022 ) on Tuesday January 09, 2018 @07:04AM (#55892279)

          I think this is the best answer. I doubt "Western Digital" had much to do with the actual software development. They probably had some web designer approve the user interface look and feel for compliance to their design standards and the rest was done who knows where.

          The downside to open source software seems to be the ease at which it allows multinationals to buy the cheapest software possible without actually having to invest much at all in software development, all they need is someplace minimally competent to glue together a bunch of open source components.

      • Re:2018 (Score:4, Interesting)

        by mikael ( 484 ) on Monday January 08, 2018 @07:29PM (#55889793)

        Look at the string "dlink". I had a laptop (Sony Viao) that would spontaneously connect to a DLink router somewhere elsewhere in our neighborhood. By spontaneously connect, I mean wi-fi was disabled by the Linux GUI options, only to see the laptop connect spontaneously to a DLink router. Because the case of the laptop was used as the wi-fi antennae, it had 100 meters range.

      • by Anonymous Coward

        5) It was intentionally and purposely put there for those times when a user contacts them (Yes, the real owner) sobbing uncontrollably because he seems to be locked out of his network drive because he forgot his password and all the pictures he had of his daughter are on there and she recently died in a car accident and he doesn't know what to do.

        • by Anonymous Coward

          Open it up, take out the drive, plug it into your desktop. Zero reason to hard code backdoors like this.

      • by sjames ( 1099 )

        I'm not so sure I want to trust my data to crappy software processes.

      • I am not in the least surprised. This isn't anything malicious, or nefarious. I'm almost certain that this was implemented intentionally for user support purposes.

        Users forgot their credentials all the time. If there is no backdoor, all their data is lost. Likely someone ran the risk matrix and determined it was better to have a backdoor that could provide access to users (likely support staff to go in and reset users password), than to have a bunch of angry users losing all their data all the time. Anyone

    • Re:2018 (Score:5, Insightful)

      by bill_mcgonigle ( 4333 ) * on Monday January 08, 2018 @07:05PM (#55889639) Homepage Journal

      They probably didn't construct it - a low-bidder did.

      "Brian" Y.G. reused the same code he did for the D-Link job, if one had to venture a guess.

      That tells you something about WD's quality.

      That they found out about this six months ago tells you something about their responsibility. It's actions like these that make class action attorneys drool while they mumble "willful negligence". It's cheaper to fix the code, IMO.

      • by santax ( 1541065 )
        In all fairness, you probably have the truth in your hands here. Thanks for sharing it.
      • If it was cheaper to fix the code, they would fix the code. Clearly it's cheaper to ship many millions of hardware devices with insecure firmware and eventually, maybe, perhaps, pay a pittance to the tiny percentage of a tiny percentage of customers who notice and care and stay interested in an esoteric class action lawsuit about a company they can't name and a product they hardly remember even owning and which on cursory inspection seems to work fine.

      • by Reziac ( 43301 ) *

        I'd guess rather that this wifi thing being outside WD's field of expertise, they perforce relied on a contractor to have the required expertise.

        How do you tell when someone doesn't actually know as much as they claim, when you know nothing about it at all?

        And I expect they're not alone.

    • by Nemyst ( 1383049 )

      This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data.

      Oh, cut the crap out with the conspiracy theories. The MyCloud system is all about allowing external access of your data (so you have your own "cloud" hosted locally), so it makes sense there'll be a way to access it. This is just plain laziness combined with zero oversight and total carelessness. It's awful, WD should be ashamed of themselves, but jumping to the "IT'S THE GUBINMENT STEALIN YER DATA" just makes you look like a fool.

    • Re:2018 (Score:4, Insightful)

      by geekmux ( 1040042 ) on Monday January 08, 2018 @08:19PM (#55890107)

      How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!

      Western Digital knows you opinion represents less than 1% of their current customer base. You mean less to them than the corporate coffee clerk being accused of sexual assault, which means they're not going to think twice about re-installing backdoors into their products if it provides them even the slightest benefit.

      Consumers simply don't give a shit. Firmware update a storage device? That will never happen across 90% of deployed product unless Western Digital does it themselves in a fully automated manner.

      • by e r ( 2847683 )
        Parent post is kind of right.

        Want to make a difference?
        Go out of your way to use open source software. At home convert everything you have to open source software. At work just do it without even asking, just choose open source tech to base your stuff on (do I even have to say "as much as possible where it won't break things"??).

        Microsoft, Intel, WD, Oracle etc. will start to get the message when their fat contracts stop getting renewed because real people who work in the tech industry are choosing ven
        • Parent post is kind of right. Want to make a difference? Go out of your way to use open source software. At home convert everything you have to open source software. At work just do it without even asking, just choose open source tech to base your stuff on (do I even have to say "as much as possible where it won't break things"??). Microsoft, Intel, WD, Oracle etc. will start to get the message when their fat contracts stop getting renewed because real people who work in the tech industry are choosing vendors that screw them less badly or choose open source solutions instead. Did anyone else notice how M$ all-a-sudden got real cozy and friendly with open source stuff in the past couple years? Yeah, they noticed that everyone was using Linux on their servers and that you can barely find even a single page of documentation for $LatestCoolFramework written for Windows rather than for *nix. When was the last time you heard everyone get excited about some ASP.NET thing or IIS or anything besides anger and annoyance at M$ and Windows 10? They tried to push their crappy little store and got a yawn or outright derision and hatred from people "who know how to use computers"; these are the same people that write the code and set up the servers and they remember the asshole moves that Oracle and M$ and Intel et al have made in the past. Microsoft noticed how they were the uncool jerks that all the programmers couldn't wait to get rid of... oh, and tralala see guys we're opening up the C# license stuff and absorbing Mono and implementing a Linux subsystem for Windows and here's this, like, totally cool text editor VisualStudio Code! See, guys and girls, we're like totally rad and cool now... They'll worry. Oh, they'll worry. Just put the pressure on... but do we even care if they reform? We can't trust that they won't go back to their abusive ways if their bottom line starts to recover. Strike abusive software companies at the neck: use open source software.

          Major vendors know your opinion represents less than 1% of their current customer base. Open-source takes far more effort than walking into [big-box store], buying crap off the shelf, and plugging it in. Laziness about technology coupled with an I-don't-give-a-shit-about-privacy mentality has been a vendors wet dream for many years now. That won't change no matter how many vulnerabilities you throw at the ignorant masses.

          And no one will get "the message" because you're never going to convince your CxOs t

    • by Anonymous Coward

      Based on the user name, it seems suspect that dlink makes these My Cloud devices. I guess WD just buys them, slaps a low performance drive in them and then slaps some branding on them

    • 1) Team A write version 1.0 of firmware for product X. Along the way, they put some hard-coded credentials in for testing.
      2) Team B is tasked to work on firmware for product Y. They fork X1.0 as a starting point (possibly without clearly stating they are doing this to Team A, so Team A isn't really aware of their existence)
      3) Team A fixes the issue in their code, makes 1.1 for product X. The uptake of the firmware by the public is 10% of the install base.
      4) Poor internal communication, and the lack of urgen

  • I gave up on consumer NAS because the permissions suck - you can't integrate with a Windows domain. So these days my 'NAS' is a USB drive shared off my server.

    ON the other hand, I'm not 100% certain (because of lack of interest once I had my own solution in place), but I believe many consumer router/modems now come with a USB port to share storage or a printer. I'd suggest investing some time in hunting down a router with that feature instead of going with a consumer NAS device.

    On my third hand... I'm not

    • by pnutjam ( 523990 )
      I just use a low power linux box, what's the appeal to hardware NAS. They are usually just a poorly configured Linux version that doesn't get patched.
      • >what's the appeal to hardware NAS.

        At the consumer level, the appeal is that it's a small box you plug in and forget unless you want to move it.

        That's why I replaced mine with a USB enclosure - so I can take the entire library wherever I want without carrying a large computer case, keyboard, and monitor with me.

  • by LeftCoastThinker ( 4697521 ) on Monday January 08, 2018 @06:37PM (#55889449)

    I was a fan of WD for a long time, I even had a couple of their NAS My Book Live drives, which were quite nice for the price and were accessible directly over the LAN, but the new "My Cloud" drives require crappy software to work and require to always be online to work, both deal killers for me. These days I only buy HGST drives (yes, I know WD owns them, but they are still made by a different group).

    • WD is everything they always were. Their software was always crappy, especially their drive tools. It stands to reason that more complex software remains equally crappy. Their drives however still are at the top of my buying list.

      As for HGST being a different group, culture is inherited from the top. Don't bet the farm on them being safe from software quality issues because "different group".

  • by Anonymous Coward

    The issue appears to be one of control. Intel wants control of their chips so they put in a secret operating system, amd did the same. John Deer doesn't want farmers to fix their tractors, cars are sold with black boxes unable to be removed or GPS taggers by the dealership they sometimes forget to remove. OnStar can remotely disable your vehicle.

    When we pay money for a product the issue of control is supposed to be that we have it, we have the item, we have the control. The idea is supposed to be that t

  • by Anonymous Coward

    I am shocked—shocked—to find that there is a back door in a "cloud" product.

  • I tried this ... (Score:4, Interesting)

    by CaptainDork ( 3678879 ) on Monday January 08, 2018 @06:59PM (#55889591)

    ... on my "WD Mycloud" wireless device that I purchased last year.

    When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."

    I checked the firmware version and it does have the latest (2.30.172).

    I do not allow access from outside the local LAN and I have to log in as Admin and enable "Share" in order to map a drive.

    I leave Share activated only during the short period of time that it takes to copy files to/from the divice and then I disable Share again.

    I'm hoping that "offline" condition protects me from intruders.

    • "Exploiting this issue to gain a remote shell as root is a rather trivial process. All an attacker has to do is send a post request that contains a file to upload using the parameter 'Filedata[0]', a location for the fileto be upload to which is specified within the 'folder' parameter, and of course a bogus 'Host' header," says James Bercegay, GulfTech Research and Development.
    • by LordKronos ( 470910 ) on Monday January 08, 2018 @07:34PM (#55889827)

      When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."

      Please tell me their "fix" wasn't a JavaScript block to prevent you from entering the password for that user.

      • 1.) Read my post again and notice I never said I entered a password.

        2.) I have no fucking clue what their fix was.

        3.) I don't even know if their fix works.

        • I think LordKronos was pointing out that the login page seemed to disallow you from trying to log into that account via a dynamic update to the web page (You went to log in and the text box updated with an X). Hopefully they actually did something more substantive to block the login, rather than simply inserting a script that blocks using that login-- the reason being that an attacker could block the script from running.

          That's a bunch of speculation, and hopefully WD isn't that stupid.

          • Thanks for the clarification, but I don't think WD is stupid.

            I think the word we're looking for is, "incompetent."

    • by Fusen ( 841730 )

      I have an EX2 and tried the username and password on the 2.11.xx firmware and it didn't let me login.

      I then read the actual original vulnerability release and you can't use the login details to sign into the UI, the username and password are hardcoded into a specific file that needs to be called via a HTTP(s) request. So you can just test this by attempting to login.

      • Thanks, but hold my hand on this one, please.

        I enter http://wdmycloud/ [wdmycloud] into my browser and, after some chum time, I'm presented with the login page.

        The only name that works in the username field is Admin.

        So you can just test this by attempting to login.

        What am I doing wrong?

        Thanks.

  • by alvinrod ( 889928 ) on Monday January 08, 2018 @07:02PM (#55889607)
    Jagger said it best: "Hey! You! Get off of my cloud!"
  • Perhaps "our cloud" would be more apt.
  • https://www.youtube.com/watch?v=VIXOOwthtaE

    Way to go idiot WD programmers, QA, supervisors, managers, and your whole stupid operation.

    Love you hard drives though.

  • by RogueWarrior65 ( 678876 ) on Monday January 08, 2018 @08:32PM (#55890173)

    So, let's say you're designing a Linux-based embedded system and you want to be able to make modifications and upgrades to the OS in the field. How do you allow for this without root access? And so what if the root user has a password? If you have to give that to a customer to perform these upgrades, that password is no longer secure.

    • Making root account accessible from internet for upgrades? You must be joking. Why cant you develop an automatic update scheme like all others ? Device should ask a public server if there is an update, notify user if there is one, download and apply it if user wants.
      • Well, not internet-based updating per se. But let's say you need to update certain libraries or perhaps install a new piece of software like PHP or something. A super user has the privilege to modify stuff in the OS directory tree so you need to allow the customer or even the updater to be a super user. How do you do that without allowing them to touch stuff you don't want them to?

        • Create an "updatebot" user, give only necessary (filesystem) rights to it, use a daemon running under that account ? Once I wrote something like that to update about a few hundred client machine's php sources which we develop. When there was an update to send clients, i was running a script which checks out release branch sources from scm, package them and uploads to public "distribution" server. It was running fine.
    • by gweihir ( 88907 )

      Very simple:
      1. Pull-only update to be triggered on device side (Incidentally, accessing such a device from outside without explicit permission is a crime, even if it is to patch...)
      2. Download with signature check
      3. Install

      I have pretty much this set-up in a cron job on my Debian servers.

  • by Anonymous Coward

    With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable. Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.

    Democrats wanted SO but never use it. Was it just a money grab as people said it was? The answer is : Yes. Another worse law by worthless liberals that costs this country BILLIONS each year. Either repeal S.O. or apply it!

    • by gweihir ( 88907 )

      Your political agenda is misplaced. Because if you look at what the conservatives do, you find it is even worse.

    • by DogDude ( 805747 )
      Dipshit, the CEO shouldn't be held accountable. They're just employees. The OWNERS OF THE COMPANY should be help liable. Unfortunately, the money-grubbing Republicans have, over decades, completely separated corporate ownership from any kind of personal liability.

      Oh, and fuck you.
    • With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable.

      But, many CFOs have been, and while , [cfo.com] there isn't evidence that CEOs have been charged [reuters.com]:

      it forces corporations to be more vigilant about financial reporting at all levels, which is likely one of the reasons there have been few accounting scandals at major public corporations since Sarbanes-Oxley took effect. In that regard, the law is doing what it’s supposed to, encouraging accountability and deterring fraud.

      Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.

      Maybe, but no under SOX, as SOX covers fraud, not product deficiencies that haven't been proven

  • Isn't the reason you bought private storage that you wanted to keep it private?

    It said NSA on the label; Dang!

    I use mine mostly to load pee videos, hoping I'll get a job in the current administration; you never know...

     

  • Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.

    • Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.

      What ratio of consumers of this product know what a VLAN is, or how to configure it? It's stupid to assume the user knows any better. The consumer has a reasonable expectation that if they are sold a "secure" product, it is actually secure.

      • Well, it does have "cloud" in the name... so security should not be assumed.

        IIRC, the web interface also defaults to no password.

  • Or intent. All damage done to be paid for by them, triple damages on top and they have to prove it was not their fault to fend that off. Or alternatively, they have to take these back, give a full refund and pay $1000 or 3 times the value for the effort to move the data, whichever is higher. Hard coded passwords are one of the most extreme and most obvious violation of basic security best practices.

    As it currently is, absolutely nothing by a bit of bad press will be happening to them and hence they will do

  • I had a drive like this, I took it down after it appeared to be making transfers in the middle of the night when all of computing equipment was shut off.

  • by itsme1234 ( 199680 ) on Tuesday January 09, 2018 @01:33AM (#55891473)

    I wonder what people are expecting. They aren't treating this seriously, at least on My Cloud Gen 2 (current) there isn't even an option to cleanly shutdown or unmount or mount read-only the main volume. Not even if you enable ssh access (which they warn you not too, for good reason as it is OpenSSH_5.0p1, probably close to 10 years old).

    This is not something you don't catch at testing, not something you design later. Anybody who used a computer since windows 95 and has some working neurons will think "hm, I'm supposed to do some tests or write some documentation on this box I have here but now that I'm done how to shut it down. Pull the plug? Nah, can't be.". They probably asked and the well practiced answer from the (inaptly called) Engineering was "just pull the plug on that 8TB ext4 volume, what can go wrong?".

  • This is a strong argument for PFSense, Smoothwall, or Falcongate

  • I seem to recall several scandals of this nature over the years. Routers, backup appliances, firewall appliances (!), cable modems, the list goes on. It wouldn't surprise me in the least to learn that some of the Smart Home hubs on the market today have similar deliberate security flaws. My question goes out to all the slashdotters who are in an I.T. support or admin role or who are on the design team for any internet capable device.

    Have these deliberately crafted backdoors ever had much legitimate use? B

6.023 x 10 to the 23rd power alligator pears = Avocado's number

Working...