All Your Western Digital MyCould Base are Belong to Us

FrgMstr

FrgMstr

Just Plain Mean
Staff member
Joined
May 18, 1997
Messages
55,601
The Exploiteers have been having some fun with its Western Digital MyCloud NAS system, and quite possibly have been having fun with your WD MyCloud device or system as well. Its writeup logs not just one or two security issues with the MyCloud systems, but an entire host of security issues. If you own any Western Digital MyCloud device, you might want to consider taking off your network at the moment now that all of this is public. Then again, if you want those "private" family moments exposed, leave it plugged in!

At Exploitee.rs, we normally attempt to work with vendors to ensure that vulnerabilities are properly released. However, after visiting the Pwnie Awards at the last BlackHat Vegas, we learned of the vendor’s reputation within the community. In particular, this vendor won a “Pwnie for Lamest Vendor Response” in a situation where the vendor ignored the severity of a set of bugs reported to them. Ignoring these bugs would leave the vulnerable devices online for longer periods while responsible disclosure is worked out. Instead we’re attempting to alert the community of the flaws and hoping that users remove their devices from any public facing portions of their networks, limiting access wherever possible. Through this process, we’re fully disclosing all of our research and hoping that this expedites the patches to users’ devices.

I did reach out to Western Digital about these issues, and got the following response this morning, so at least we know WD knows....now.

I am working with our team now on this and will hopefully have a respond by end of day.
 
Those are not exploits, those are gaping backdoors made by someone who wrote that code with his first PHP programming book. That book was also probably made for PHP4.
 
Ij ust bought one of these MyCloud EX2's at 16TB... not for the NAS b.s. But for the cheap 8TB drives in it! Have to wait a month for it to come in stock though! Sure beats teh prices of 8TB drives here in AUS. Our price down here for one is, you're left nut + kidney.
 
Those private family moments could be fun to see if it involves an attractive woman...
 
  • Like
Reactions: Oned
like this
Having been the Box admin at work (healthcare) and knowing what's mostly secure vs what's not, anyone using the cloud for personal data is basing their security on obscurity. What price convenience? IOT=IOS
 
I like how one of WD's steps to secure the devices is to allow automatic installation of un-tested updates from a remote source.
 
I have one of these, but have not only disabled the remote features, but have also blocked it's access to the WAN completely. This means I have to download and install updates manually, but that's a minor inconvenience. I plan on putting together a FreeNAS server this year to replace it, but for now it serves its purpose.
 
PaulP said:
I have one of these, but have not only disabled the remote features, but have also blocked it's access to the WAN completely. This means I have to download and install updates manually, but that's a minor inconvenience. I plan on putting together a FreeNAS server this year to replace it, but for now it serves its purpose.
Click to expand...

Even if it hits their site it's just a proxy. I don't see how this affects anything other than local attacks, unless you've tossed your mycloud on your dmz... which is dumb.
 
You must log in or register to reply here.
Back
Top