Western Digital 'My Cloud' Devices Have a Hardcoded Backdoor (betanews.com) 160
BrianFagioli shares a report from BetaNews: Today, yet another security blunder becomes publicized, and it is really bad. You see, many Western Digital MyCloud NAS drives have a hardcoded backdoor, meaning anyone can access them -- your files are at risk. It isn't even hard to take advantage of it -- the username is "mydlinkBRionyg" and the password is "abc12345cba" (without quotes). To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing. GulfTech Research and Development explains, "The triviality of exploiting this issues makes it very dangerous, and even wormable. Not only that, but users locked to a LAN are not safe either. An attacker could literally take over your WDMyCloud by just having you visit a website where an embedded iframe or img tag make a request to the vulnerable device using one of the many predictable default hostnames for the WDMyCloud such as 'wdmycloud' and 'wdmycloudmirror' etc." The My Cloud Storage devices affected by this backdoor include: MyCloud, MyCloudMirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100. Firmware 2.30.172 reportedly fixes the bug, so make sure your device is updated before reconnecting to the internet.
12345? (Score:1)
Re: (Score:3)
Nah. Always Be Careful... 12345... Can't Be Assed.
Re: (Score:1)
No, it is showing that a simple way to break into something was known 31 years ago by a non-IT person yet the same stupid way of thinking about security is still being used today.
E.C.P.
Re:12345? (Score:5, Funny)
Tha movie you're referencing came out 31 years ago. Your age is showing.
I'm shocked - shocked! - to find that old movie references are going on in here!
Re: (Score:3)
Re: (Score:2)
I'm shocked - shocked! - to find that old movie references are going on in here!
Inconceivable!
Re: (Score:2)
I've seen most of it.
Re: (Score:3)
Re: (Score:1)
Tha movie you're referencing came out 31 years ago. Your age is showing.
The only thing this reference is showing is that stupidity and ignorance, is timeless.
"are timeless" Your verb number should agree with your subject.
Re: (Score:3, Funny)
12345? That's the same combination as my luggage!
Per TSA regulations :-)
Re: (Score:1)
12345? That's the same combination as my luggage!
That's some pretty secure luggage. I've rarely seen luggage locks that go past 1234. Not that it matters. Even the ones the TSA can unlock they just throw away. I gave up on luggage locks within the first month of the existence of the TSA.
Re:"Hardcoded"? (Score:5, Insightful)
...it was disclosed to Western Digital six months ago and the company did nothing.
Firmware 2.30.172 reportedly fixes the bug...
Also, I don't think releasing a firmware update is doing nothing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Considering that I own one of these devices, AND I participate frequently on the WD community group for this device, I can confirm that the base package is identical between consumer and midsize business class offerings. I can *ALSO* confirm that we have proposed workable patches on many numerous occasions, in every "Leave feedback" location WD makes available. (Protip, THEY IGNORE US.)
At least on the older Gen1 consumer mycloud units, the web interface and the /etc/passwd file were hosted by a real, writ
Re:"Hardcoded"? (Score:4)
"Bug"? Yeah, me neither.
As for "hardcoded", I don't think the word means what you think it means.
Re:"Hardcoded"? (Score:4, Insightful)
Hard coded means written into the software as opposed to being user configurable. So the author is correct and you were wrong.
Hardcoded is why it takes a firmware update to change it rather than go to setup page x and uncheck the box next to "big security hole".
predictable default hostnames (Score:4, Funny)
... using one of the many predictable default hostnames ...
Good thing I renamed mine to "FutureCorruptedBackup" ;-)
WD did nothing! (Score:1)
"To make matters worse, it was disclosed to Western Digital six months ago and the company did nothing." ... "Firmware 2.30.172 reportedly fixes the bug"
hmm...
Re: (Score:3)
So, OK, June 16 to November 16 is only 5 months.
But their release notes don't even mention the severity of the problem and the importance of installing the updated firmware!
Re: (Score:3)
Re: (Score:2)
Have you ever seen a patch that didn't say that, though?
Re:WD did nothing! (Score:5, Insightful)
... the company apparently did nothing until November 2017.
Standard procedure (Score:2, Informative)
Whenever I buy a new external drive the first thing I do is repartition it to get rid of whatever shitty software they included and reformat it.
Re: (Score:2)
Re: (Score:3)
You TOTALLY CAN do that on the MyCloud.
The boot loader looks for an unsigned kernel and initrd on a specific partition, formatted as FAT32, with a specific file name.
You can bake your own and put it on the drive, and the mycloud will boot that image and initrd without complaints.
In the community pages, we have been working on a straight up clean debian for quite some time. There are instructions on how to configure and compile your own kernel from the stock device tree.
Re: (Score:1)
2018 (Score:3, Informative)
Re: (Score:3)
>How can it be possible that a big company like Western Digital constructs a backdoor to your personal data?
It's not unheard of for companies to do this on consumer devices, for technical support to assist people who lock themselves out of devices and don't want to lose data. Up until now I'd only ever seen it in rebranded modems bundled with DSL service, but for a while it was difficult to avoid.
I agree it was never a good idea, and nowadays it should be considered criminal.
Re: (Score:1)
I remember buying a very early laptop which had BIOS password protection. One time I forgot the password, called the store asking how I can reset it. "Oh, you'll have to bring it into the store for our technicians to work on in our workshop. It has to be done there, as we can't let you see the recovery process." So I removed each back panel, found the password reset DIM switch, and reset the password.
Re:2018 (Score:5, Insightful)
How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!
It's a massive screwup, though we don't really know how it got there yet, a few quick scenarios are:
1) It could have been a deliberate backdoor for WD, the government, etc, that was sanctioned by the highest levels of the company, but this seems quite unlikely.
2) It could be a malicious employee (or even outside attacker) who introduced the backdoor for their own purposes.
3) An individual or team who didn't know any better put it there.
4) An individual or team added it for testing purposes, and people forget and never pulled it out.
My money would be on 3 or 4, reading the advisory from the security researcher it sounds like there was a lot of sloppiness in the WD code.
It sounds like it was inherited from another WD product that got patched in 2014 (but the patch was never ported to this device) so my money is on crappy software processes.
Re: (Score:1)
Re: (Score:1)
You can bet your ass that the NSA backdoor isn't easy to find like this. If you find incompetence "hard to believe", you've got to be new to Earth.
Re: (Score:3, Informative)
I'll tell you exactly how it got there: firmware and software development for consumer garbage like this is outsourced to the deepest, darkest bowels of China and India. The code is copied and pasted from the last project, or open source stuff is smashed together until it basically works and they ship it. In this particular case, maybe it was a convenience during development, or maybe there was an organized plan to take advantage of dumb (American) consumers who would never know any better.
Welcome to the
Re: 2018 (Score:1)
This. It was probably there for testing and they never took it out.
Re:2018 (Score:4, Interesting)
I think this is the best answer. I doubt "Western Digital" had much to do with the actual software development. They probably had some web designer approve the user interface look and feel for compliance to their design standards and the rest was done who knows where.
The downside to open source software seems to be the ease at which it allows multinationals to buy the cheapest software possible without actually having to invest much at all in software development, all they need is someplace minimally competent to glue together a bunch of open source components.
Re:2018 (Score:4, Interesting)
Look at the string "dlink". I had a laptop (Sony Viao) that would spontaneously connect to a DLink router somewhere elsewhere in our neighborhood. By spontaneously connect, I mean wi-fi was disabled by the Linux GUI options, only to see the laptop connect spontaneously to a DLink router. Because the case of the laptop was used as the wi-fi antennae, it had 100 meters range.
Re: (Score:2)
Not me. SystemD wasn't around at the time on Fedora. I still have the OS partition/drive, as at the same time, the DVD/CD drive stopped working, so I couldn't upgrade.
Re: (Score:1)
5) It was intentionally and purposely put there for those times when a user contacts them (Yes, the real owner) sobbing uncontrollably because he seems to be locked out of his network drive because he forgot his password and all the pictures he had of his daughter are on there and she recently died in a car accident and he doesn't know what to do.
Re: 2018 (Score:1)
Open it up, take out the drive, plug it into your desktop. Zero reason to hard code backdoors like this.
Re: (Score:2)
I'm not so sure I want to trust my data to crappy software processes.
Calm Down and adjust your tinfoil hat. (Score:3)
I am not in the least surprised. This isn't anything malicious, or nefarious. I'm almost certain that this was implemented intentionally for user support purposes.
Users forgot their credentials all the time. If there is no backdoor, all their data is lost. Likely someone ran the risk matrix and determined it was better to have a backdoor that could provide access to users (likely support staff to go in and reset users password), than to have a bunch of angry users losing all their data all the time. Anyone
Re:2018 (Score:5, Insightful)
They probably didn't construct it - a low-bidder did.
"Brian" Y.G. reused the same code he did for the D-Link job, if one had to venture a guess.
That tells you something about WD's quality.
That they found out about this six months ago tells you something about their responsibility. It's actions like these that make class action attorneys drool while they mumble "willful negligence". It's cheaper to fix the code, IMO.
Re: (Score:2)
Re: (Score:2)
If it was cheaper to fix the code, they would fix the code. Clearly it's cheaper to ship many millions of hardware devices with insecure firmware and eventually, maybe, perhaps, pay a pittance to the tiny percentage of a tiny percentage of customers who notice and care and stay interested in an esoteric class action lawsuit about a company they can't name and a product they hardly remember even owning and which on cursory inspection seems to work fine.
Re: (Score:2)
I'd guess rather that this wifi thing being outside WD's field of expertise, they perforce relied on a contractor to have the required expertise.
How do you tell when someone doesn't actually know as much as they claim, when you know nothing about it at all?
And I expect they're not alone.
Re: (Score:1)
This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data.
Oh, cut the crap out with the conspiracy theories. The MyCloud system is all about allowing external access of your data (so you have your own "cloud" hosted locally), so it makes sense there'll be a way to access it. This is just plain laziness combined with zero oversight and total carelessness. It's awful, WD should be ashamed of themselves, but jumping to the "IT'S THE GUBINMENT STEALIN YER DATA" just makes you look like a fool.
Re:2018 (Score:4, Insightful)
How can it be possible that a big company like Western Digital constructs a backdoor to your personal data? Such a company - and it's owners - should shut down, prosecuted and put behind bars for many - many - years... This is not an accident. This is making sure by design they (and maybe their partners, workforce, ex-workforce and 3-letter agencies) have acces to your private data. I for one will never buy another device from Western. Who knows what they have done to the IC's in their harddisks to provide access to my data. I can not look into a chip and they know that!
Western Digital knows you opinion represents less than 1% of their current customer base. You mean less to them than the corporate coffee clerk being accused of sexual assault, which means they're not going to think twice about re-installing backdoors into their products if it provides them even the slightest benefit.
Consumers simply don't give a shit. Firmware update a storage device? That will never happen across 90% of deployed product unless Western Digital does it themselves in a fully automated manner.
Re: (Score:2)
Want to make a difference?
Go out of your way to use open source software. At home convert everything you have to open source software. At work just do it without even asking, just choose open source tech to base your stuff on (do I even have to say "as much as possible where it won't break things"??).
Microsoft, Intel, WD, Oracle etc. will start to get the message when their fat contracts stop getting renewed because real people who work in the tech industry are choosing ven
Re: (Score:2)
Parent post is kind of right. Want to make a difference? Go out of your way to use open source software. At home convert everything you have to open source software. At work just do it without even asking, just choose open source tech to base your stuff on (do I even have to say "as much as possible where it won't break things"??). Microsoft, Intel, WD, Oracle etc. will start to get the message when their fat contracts stop getting renewed because real people who work in the tech industry are choosing vendors that screw them less badly or choose open source solutions instead. Did anyone else notice how M$ all-a-sudden got real cozy and friendly with open source stuff in the past couple years? Yeah, they noticed that everyone was using Linux on their servers and that you can barely find even a single page of documentation for $LatestCoolFramework written for Windows rather than for *nix. When was the last time you heard everyone get excited about some ASP.NET thing or IIS or anything besides anger and annoyance at M$ and Windows 10? They tried to push their crappy little store and got a yawn or outright derision and hatred from people "who know how to use computers"; these are the same people that write the code and set up the servers and they remember the asshole moves that Oracle and M$ and Intel et al have made in the past. Microsoft noticed how they were the uncool jerks that all the programmers couldn't wait to get rid of... oh, and tralala see guys we're opening up the C# license stuff and absorbing Mono and implementing a Linux subsystem for Windows and here's this, like, totally cool text editor VisualStudio Code! See, guys and girls, we're like totally rad and cool now... They'll worry. Oh, they'll worry. Just put the pressure on... but do we even care if they reform? We can't trust that they won't go back to their abusive ways if their bottom line starts to recover. Strike abusive software companies at the neck: use open source software.
Major vendors know your opinion represents less than 1% of their current customer base. Open-source takes far more effort than walking into [big-box store], buying crap off the shelf, and plugging it in. Laziness about technology coupled with an I-don't-give-a-shit-about-privacy mentality has been a vendors wet dream for many years now. That won't change no matter how many vulnerabilities you throw at the ignorant masses.
And no one will get "the message" because you're never going to convince your CxOs t
Re: (Score:1)
Based on the user name, it seems suspect that dlink makes these My Cloud devices. I guess WD just buys them, slaps a low performance drive in them and then slaps some branding on them
Re: (Score:3)
1) Team A write version 1.0 of firmware for product X. Along the way, they put some hard-coded credentials in for testing.
2) Team B is tasked to work on firmware for product Y. They fork X1.0 as a starting point (possibly without clearly stating they are doing this to Team A, so Team A isn't really aware of their existence)
3) Team A fixes the issue in their code, makes 1.1 for product X. The uptake of the firmware by the public is 10% of the install base.
4) Poor internal communication, and the lack of urgen
This makes me glad I gave up on consumer NAS (Score:2)
I gave up on consumer NAS because the permissions suck - you can't integrate with a Windows domain. So these days my 'NAS' is a USB drive shared off my server.
ON the other hand, I'm not 100% certain (because of lack of interest once I had my own solution in place), but I believe many consumer router/modems now come with a USB port to share storage or a printer. I'd suggest investing some time in hunting down a router with that feature instead of going with a consumer NAS device.
On my third hand... I'm not
Re: (Score:2)
Re: (Score:2)
>what's the appeal to hardware NAS.
At the consumer level, the appeal is that it's a small box you plug in and forget unless you want to move it.
That's why I replaced mine with a USB enclosure - so I can take the entire library wherever I want without carrying a large computer case, keyboard, and monitor with me.
Re: (Score:2)
Re: (Score:2)
Because for large amount of data, sneakernet is still more convenient.
Re: (Score:2)
WD is not what it used to be (Score:3)
I was a fan of WD for a long time, I even had a couple of their NAS My Book Live drives, which were quite nice for the price and were accessible directly over the LAN, but the new "My Cloud" drives require crappy software to work and require to always be online to work, both deal killers for me. These days I only buy HGST drives (yes, I know WD owns them, but they are still made by a different group).
Re: (Score:2)
WD is everything they always were. Their software was always crappy, especially their drive tools. It stands to reason that more complex software remains equally crappy. Their drives however still are at the top of my buying list.
As for HGST being a different group, culture is inherited from the top. Don't bet the farm on them being safe from software quality issues because "different group".
backdoor!==secure (Score:1)
The issue appears to be one of control. Intel wants control of their chips so they put in a secret operating system, amd did the same. John Deer doesn't want farmers to fix their tractors, cars are sold with black boxes unable to be removed or GPS taggers by the dealership they sometimes forget to remove. OnStar can remotely disable your vehicle.
When we pay money for a product the issue of control is supposed to be that we have it, we have the item, we have the control. The idea is supposed to be that t
The subject is the *#^% article (Score:1)
I am shocked—shocked—to find that there is a back door in a "cloud" product.
I tried this ... (Score:4, Interesting)
... on my "WD Mycloud" wireless device that I purchased last year.
When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."
I checked the firmware version and it does have the latest (2.30.172).
I do not allow access from outside the local LAN and I have to log in as Admin and enable "Share" in order to map a drive.
I leave Share activated only during the short period of time that it takes to copy files to/from the divice and then I disable Share again.
I'm hoping that "offline" condition protects me from intruders.
Re: (Score:2)
Re: I tried this ... (Score:5, Insightful)
When I entered the username, "mydlinkBRionyg" (without the quotes), the text box had an "X" in it, saying, "Only administrator users are allowed."
Please tell me their "fix" wasn't a JavaScript block to prevent you from entering the password for that user.
Re: (Score:2)
1.) Read my post again and notice I never said I entered a password.
2.) I have no fucking clue what their fix was.
3.) I don't even know if their fix works.
Re: (Score:2)
I think LordKronos was pointing out that the login page seemed to disallow you from trying to log into that account via a dynamic update to the web page (You went to log in and the text box updated with an X). Hopefully they actually did something more substantive to block the login, rather than simply inserting a script that blocks using that login-- the reason being that an attacker could block the script from running.
That's a bunch of speculation, and hopefully WD isn't that stupid.
Re: (Score:2)
Thanks for the clarification, but I don't think WD is stupid.
I think the word we're looking for is, "incompetent."
Re: (Score:2)
I have an EX2 and tried the username and password on the 2.11.xx firmware and it didn't let me login.
I then read the actual original vulnerability release and you can't use the login details to sign into the UI, the username and password are hardcoded into a specific file that needs to be called via a HTTP(s) request. So you can just test this by attempting to login.
Re: (Score:2)
Thanks, but hold my hand on this one, please.
I enter http://wdmycloud/ [wdmycloud] into my browser and, after some chum time, I'm presented with the login page.
The only name that works in the username field is Admin.
So you can just test this by attempting to login.
What am I doing wrong?
Thanks.
Re: (Score:2)
Well, fry me for an oyster but I was hoping for a "do this," answer.
Thanks anyway.
Jagger said it best (Score:4, Funny)
needs new name (Score:2)
*Points and Laughs* Ha Ha! (Score:1)
https://www.youtube.com/watch?v=VIXOOwthtaE
Way to go idiot WD programmers, QA, supervisors, managers, and your whole stupid operation.
Love you hard drives though.
Serious question (Score:3)
So, let's say you're designing a Linux-based embedded system and you want to be able to make modifications and upgrades to the OS in the field. How do you allow for this without root access? And so what if the root user has a password? If you have to give that to a customer to perform these upgrades, that password is no longer secure.
Re: (Score:1)
Re: (Score:2)
Well, not internet-based updating per se. But let's say you need to update certain libraries or perhaps install a new piece of software like PHP or something. A super user has the privilege to modify stuff in the OS directory tree so you need to allow the customer or even the updater to be a super user. How do you do that without allowing them to touch stuff you don't want them to?
Re: (Score:1)
Re: (Score:2)
Very simple:
1. Pull-only update to be triggered on device side (Incidentally, accessing such a device from outside without explicit permission is a crime, even if it is to patch...)
2. Download with signature check
3. Install
I have pretty much this set-up in a cron job on my Debian servers.
And will Sarsbane-Oxley be applied? (Score:2, Interesting)
With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable. Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.
Democrats wanted SO but never use it. Was it just a money grab as people said it was? The answer is : Yes. Another worse law by worthless liberals that costs this country BILLIONS each year. Either repeal S.O. or apply it!
Re: (Score:2)
Your political agenda is misplaced. Because if you look at what the conservatives do, you find it is even worse.
Re: (Score:2)
Oh, and fuck you.
Re: (Score:2)
With Sarsbane-Oxley passed years ago, not a single CEO has been held accountable.
But, many CFOs have been, and while , [cfo.com] there isn't evidence that CEOs have been charged [reuters.com]:
Yet, this is ANOTHER case where the CEO SHOULD be an MUST be held accountable for allowing their company to produce a clear and dangerous product deficency.
Maybe, but no under SOX, as SOX covers fraud, not product deficiencies that haven't been proven
Why would you buy a NSA drive? (Score:2)
Isn't the reason you bought private storage that you wanted to keep it private?
It said NSA on the label; Dang!
I use mine mostly to load pee videos, hoping I'll get a job in the current administration; you never know...
Re: (Score:2)
I didn't think anyone would get it, lol. (Score:2)
Facebook has killed critical thinking. :)
Of course they do (Score:2)
Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.
Re: (Score:2)
Not placing this type of equipment on a dedicated, protected VLAN with no external access and no untrusted internal access was always stupid. Sure, that might not provide bulletproof security, but it is pretty good for my backups.
What ratio of consumers of this product know what a VLAN is, or how to configure it? It's stupid to assume the user knows any better. The consumer has a reasonable expectation that if they are sold a "secure" product, it is actually secure.
Re: (Score:2)
Well, it does have "cloud" in the name... so security should not be assumed.
IIRC, the web interface also defaults to no password.
Time to call this gross negligence (Score:2)
Or intent. All damage done to be paid for by them, triple damages on top and they have to prove it was not their fault to fend that off. Or alternatively, they have to take these back, give a full refund and pay $1000 or 3 times the value for the effort to move the data, whichever is higher. Hard coded passwords are one of the most extreme and most obvious violation of basic security best practices.
As it currently is, absolutely nothing by a bit of bad press will be happening to them and hence they will do
So thats why my light was blinking all the time (Score:2)
I had a drive like this, I took it down after it appeared to be making transfers in the middle of the night when all of computing equipment was shut off.
joke product, there isn't even a shutdown option (Score:4, Interesting)
I wonder what people are expecting. They aren't treating this seriously, at least on My Cloud Gen 2 (current) there isn't even an option to cleanly shutdown or unmount or mount read-only the main volume. Not even if you enable ssh access (which they warn you not too, for good reason as it is OpenSSH_5.0p1, probably close to 10 years old).
This is not something you don't catch at testing, not something you design later. Anybody who used a computer since windows 95 and has some working neurons will think "hm, I'm supposed to do some tests or write some documentation on this box I have here but now that I'm done how to shut it down. Pull the plug? Nah, can't be.". They probably asked and the well practiced answer from the (inaptly called) Engineering was "just pull the plug on that 8TB ext4 volume, what can go wrong?".
Firewalls. (Score:2)
This is a strong argument for PFSense, Smoothwall, or Falcongate
are backdoors ever used legitimately? (Score:2)
Have these deliberately crafted backdoors ever had much legitimate use? B
Re: (Score:2)
Re: (Score:1)
Who said they were quick to fix it?
But if we have two pieces of information, "They did nothing" and also "it is fixed", then that causes some confusion.
Re: (Score:2)