Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live devices

[mikeho1999]

I'd love to take a moment to talk about the quality of the code (assuming that the full code listing that the Ars article links to is accurate).

It's pretty clear that there are no coding standards, sparse comments (literally just 1), lots of mixed tab/spacing, misspelled names, etc.

Furthermore, the fact that this got into production shows that either the code wasn't even reviewed prior to release and/or it wasn't reviewed carefully.

I think this goes to a much larger issue of devices in this so-called IoT world we live in now. So many of these devices are built by "hardware-first" companies, who oftentimes put very little budget, time or emphasis on the software side of things. As people's daily lives depend more and more on IoT devices, I think this should be more and more of a concern: it doesn't matter how good the hardware is and/or how cost efficient a company's hardware production capability is if you don't value the quality in the software that runs said hardware.

(Full Disclosure: I'm a full-time independent software developer who has worked on many IoT projects, working directly with hardware and device manufacturers)

[shortformblog]

This is probably also reflected by the fact that they stopped patching it relatively early in its life. Three years of patches for what is effectively an internet-connected hard drive, presumably one that its target audience is going to be using for many years as something that “just works,” reflects a disinterest by Western Digital in living up to its own sales pitch.

[alpha_squared]

Several years back, I did an internship at Western Digital. I was a software intern on a hardware team in testing working on a project that no one on the team was capable of doing. It quickly became obvious it was more appropriate for a contractor to build than an intern, and was even told as much, but they went with the intern route because it "required fewer signatures".

It was glaringly obvious that software was not part of the company's core competency. Worse, was that software was treated as a nuisance and afterthought to the hardware. No idea how today's Western Digital compares, but I generally steer clear of the company's products that rely on any non-trivial software.

[Sanzig]

I think part of the problem is that the industry doesn't seem to value embedded software engineers. The work embedded software folks do is just as complicated as that of a full-stack developer working for a SaaS company, but the salaries aren't comparable.

It doesn't help things that the skill sets are very transferrable. It's tough to find somebody willing to forego 20-30% of salary just because they enjoy embedded - after a while, people get fed up and move into better paid SE roles. So, embedded software departments are often short-handed. A former employer of mine lost a senior firmware engineer almost three years ago. As far as I know, they still haven't filled the position.

[res0nat0r]

You'd likely be shocked/scared at the amount of terrible code which is out there in the wild running at any time in large companies. Mostly it is outsourced to the cheapest possible vendor, many times who have barely a grasp of what they're doing, and for sure don't understand or think about best security practices.

[tibbydudeza]

Usually a OEM does a proof of concept cobbled together linux based firmware to demo the capability of it's new SOC to prospective buyers.

WD then takes the OEM POC firmware - slaps on their logos and ships it.

That is why I would trust NAS manufacturers like Synology or Thecus or QNAP more -personally I use Unraid.

[eqvinox]

> Abdine has come up with a plausible theory—that one hacker first exploited CVE-2018-18472 and a rival hacker later exploited the other vulnerability in an attempt to wrest control of those already compromised devices.

Excluding straight vandalism, I can't really come up with another reason for the reported sequence of events. Presumably the first attacker wanted to build a botnet (which is actually something they can draw profit from), and a competitor wanted to prevent them from doing that.

Otherwise — again, excluding straight vandalism — what is the benefit of wiping the devices? Having your preexisting botnet target/scan and exploit these devices isn't free. What else could they have been trying to gain?

[tyingq]

Watching the world burn. There are plenty of examples of worms/viruses that bring no benefit to the creator. I know you said "excluding", but it's popular.

Alternatively, some misguided "white knight" idea. Maybe the factory reset turns off the "open to the internet" setting.

[dannyw]

A put option on WD stock?

Realistically speaking, you are probably going to be able to hide ~$100-$250k of put earnings, especially if you have a trading history and it's not the only thing you trade.

That can be a considerable payout.

[frombody]

What I don't get is why are people directly connecting these devices to the internet?

The logs in the article show these devices being accessed from the internet.

There have been many people in this forum mentioning how their data is gone, and I'm doubting most of the people here are directly connecting their devices to the internet .. which makes me feel like there is something more going on.

[tgragnato]

Or the botnet was DDoSing, and someone decided they had enough. (it would not be the first time)

[shadilay]

Incompetence probably, there's really no downside when experimenting with others' devices (aside from legal).

[tyingq]

A post with pretty deep detail: https://censys.io/blog/cve-2018-18472-western-digital-my-boo...

[flatiron]

first HN article had a bunch of people saying there were devices behind a NAT with no port forwarding that had the issue, this doesn't describe what happened there (if that actually happened)

[iJohnDoe]

The developer probably commented out the authentication begrudgingly because he was requested to do so.

If a user forgets their password or buys a used drive then they won’t know the password. It’s common in the hardware industry to be able to factory reset a device somehow.

[MR4D]

> If a user forgets their password or

Isn't this the reason for a hardware reset button?

Having this available over the internet is probably negligent.

[kova12]

Or he just was working on a feature, and got annoyed with password prompts. Commented out authorization code, then forgot to comment it back in

[genghizkhan]

Why would someone comment out authentication for reset? I mean, what possible reason is there for doing so? It doesn't make security any better and it's not something which impacts day-to-day performance in any way.

[bellyfullofbac]

The most infuriating answer would be maybe they were testing the restore function, and was tired of entering the test username and password over and over again. And then the "I'll just comment it out for my tests" got commited, and built, and deployed.

[sgerenser]

If a user forgets their password, they still need a way to factory reset so as not to brick the device. Of course, this should involve, say pressing and holding physical button on the device. Just commenting out the password check was probably a lot easier.

[prirun]

If one of these devices is sold, the new owner may want or need to do a reset but doesn't know the password.

[spideymans]

Was likely done in development by a developer that was sick of seeing the same password prompt 50 times a day, and who later forgot to un-comment it. There's absolutely no way this should have made it past code review.

[theropost]

Ouuf, I was wondering what happened to all my data on my old My Book live - I'm okay with my own incompetence or network security, however I'm not okay with WD's incompetence

[vxNsr]

Just curious, did you have remote (WAN) access set up?

I have one of these at my parents house, I had them unplug it, once I read this, but I was always wary of turning on remote access, as in it would only be accessible from the LAN, I haven't had a chance to go back in and check if it was hit, but I'd like to think that without remote access turned on it wasn't vulnerable.

[gentleman11]

I have 2 backups of most data but these stories make me worry. It is so time consuming. Easy to forget to maintain, & test.

[johnnyApplePRNG]

I am kind of surprised they didn't ransomware them all.

Is it not possible for some reason on these limited devices?

[pacman128]

How would they contact the owner of the device? All they know is the IP address of the device.

[ALittleLight]

I would've thought that destroying your users' data in vast amounts would be bad for the company. Surely this would shatter user trust? Who would buy something like this from Western Digital in the future?

And yet, their stock price seems unaffected. It was slightly up, though just in the way it randomly fluctuates, on the day of the announcement.

[racl101]

Can anyone clarify?

Is this a vulnerability of all My Book drives or just ones that connect to a cloud / online service?

I have one of these but haven't plugged it in for a while. However, I don't remember using any online service with it. It just had a bunch of movies.

[ayngg]

It applies to the "My Book Live" version.

[oldgradstudent]

> As the following script shows, however, a Western Digital developer created five lines of code to password-protect the reset command. For unknown reasons, the authentication check was cancelled, or in developer parlance, was commented out as indicated by the double / character at the beginning of each line.

  function get($urlPath, $queryParams=null, $ouputFormat='xml'){
  // if(!authenticateAsOwner($queryParams))
  // {
  // header("HTTP/1.0 401 Unauthorized");
  // return;
  // }

[CodeWriter23]

Never thought I’d see Ars explain what “commenting out” means.

[axiosgunnar]

> ouputFormat

[ksec]

Does anyone know what happens to those Data? Do WD offer some sort of Data Rescue Services?

[rincebrain]

As far as I can tell, WD's response is "too bad so sad you should have bought a newer product", so I don't think they offer affected people any sort of recovery gratis.

(I suspect this will bite them in the ass in the court of public opinion, but we'll see.)

[vxNsr]

Not sure what "factory reset" means, likely just deleting the MBR or something like that, the data is likely recoverable using consumer data recovery tools.

[fuzzfactor]

Is everybody sure every sector of their valuable data has been overwritten?

[fullstop]

I wonder if they were looking for wallet.dat files?

[pkulak]

Petabytes of personal data on the open internet secured with PHP. Holy crap.

[ascagnel_]

It's not that it's secured with PHP, it's that it's not secured properly. Given the scale of this screw-up, there's nothing tying it to PHP, and it could've been done in the HN language/platform du jour.

[lmilcin]

Yep. We are talking about cloud services revolution but the sad fact is that I can't trust these incompetents with my shopping list and need to maintain all my data and backups myself.

[Jedd]

The commented out function - if a verbatim copy of deployed code was in fact presented - seems to not include function name and opening brace, but does comment out the function proper and closing brace, which, and it's been a while since I did anything with PHP, would mean a syntax error on run, right?

[hnbear]

Snippet supplied in the article:

  function get($urlPath, $queryParams=null,   $ouputFormat='xml'){
  // if(!authenticateAsOwner($queryParams))
  // {
  // header("HTTP/1.0 401 Unauthorized");
  // return;
  // }

That if statement is checking for authentication before running the rest of the function. Just the if check is commented out.

Assuming here the rest of that function would come below it, with a closing brace.

ie:

  function get($urlPath, $queryParams=null, $ouputFormat='xml'){
  // if(!authenticateAsOwner($queryParams))
  // {
  // header("HTTP/1.0 401 Unauthorized");
  // return;
  // }
  
  do;
  something;
  here;
  then;  
  }

[Gaelan]

Here's the snippet from the article:

  function get($urlPath, $queryParams=null, $ouputFormat='xml'){
  // if(!authenticateAsOwner($queryParams))
  // {
  // header("HTTP/1.0 401 Unauthorized");
  // return;
  // }

The closing brace there corresponds to the if. The rest of the body of the function, and its closing brace, are outside the snippet included in the article.

[Sanzig]

The commented-out closing brace is for the if statement, not the whole function. The rest of the function was snipped, you can see the whole thing here: https://paste.debian.net/plainh/7630c424

[wizzwizz4]

It comments out the `if` block, but not the rest of the function.