[HN Gopher] Hackers exploited 0-day, not 2018 bug, to mass-wipe ...
___________________________________________________________________
Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live
devices
Author : oldgradstudent
Score : 229 points
Date : 2021-06-29 12:27 UTC (10 hours ago)
(HTM) web link (arstechnica.com)
(TXT) w3m dump (arstechnica.com)
| oldgradstudent wrote:
| > As the following script shows, however, a Western Digital
| developer created five lines of code to password-protect the
| reset command. For unknown reasons, the authentication check was
| cancelled, or in developer parlance, was commented out as
| indicated by the double / character at the beginning of each
| line. function get($urlPath, $queryParams=null,
| $ouputFormat='xml'){ //
| if(!authenticateAsOwner($queryParams)) // { //
| header("HTTP/1.0 401 Unauthorized"); // return; // }
| axiosgunnar wrote:
| > ouputFormat
| [deleted]
| CodeWriter23 wrote:
| Never thought I'd see Ars explain what "commenting out" means.
| beerandt wrote:
| It's not the site it used to be.
|
| Forums are all but dead.
|
| Comments alone have kept me from visiting the site for a
| while now.
|
| Used to be one of the sites I'd check daily, now I don't even
| like to click through on articles like these.
| CodeWriter23 wrote:
| I don't begrudge the founders taking their payday. That
| said, I really do miss the special place they made.
| ivrrimum wrote:
| lol, this is why TDD should be government mandated for
| companies which have reached at least 1 million users or
| government systems.
| pkulak wrote:
| Petabytes of personal data on the open internet secured with PHP.
| Holy crap.
| lmilcin wrote:
| Yep. We are talking about cloud services revolution but the sad
| fact is that I can't trust these incompetents with my shopping
| list and need to maintain all my data and backups myself.
| ascagnel_ wrote:
| It's not that it's secured with PHP, it's that it's not secured
| properly. Given the scale of this screw-up, there's nothing
| tying it to PHP, and it could've been done in the HN
| language/platform du jour.
| pkulak wrote:
| Maybe it's not the language, maybe it's all correlation and
| no causation, but software that happens to have been written
| in PHP does not have a stellar security track record. My logs
| don't fill up with lines like: HTTP POST
| /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
|
| for no reason whatsoever.
| ksec wrote:
| Does anyone know what happens to those Data? Do WD offer some
| sort of Data Rescue Services?
| vxNsr wrote:
| Not sure what "factory reset" means, likely just deleting the
| MBR or something like that, the data is likely recoverable
| using consumer data recovery tools.
| sgerenser wrote:
| Not if encryption was enabled. Anyone know if these devices
| had full disk encryption?
| vxNsr wrote:
| I don't recall seeing that option in the one I set up for
| my parents.
| rincebrain wrote:
| As far as I can tell, WD's response is "too bad so sad you
| should have bought a newer product", so I don't think they
| offer affected people any sort of recovery gratis.
|
| (I suspect this will bite them in the ass in the court of
| public opinion, but we'll see.)
| [deleted]
| Jedd wrote:
| The commented out function - if a verbatim copy of deployed code
| was in fact presented - seems to not include function name and
| opening brace, but does comment out the function proper and
| closing brace, which, and it's been a while since I did anything
| with PHP, would mean a syntax error on run, right?
| Gaelan wrote:
| Here's the snippet from the article: function
| get($urlPath, $queryParams=null, $ouputFormat='xml'){ //
| if(!authenticateAsOwner($queryParams)) // { //
| header("HTTP/1.0 401 Unauthorized"); // return; //
| }
|
| The closing brace there corresponds to the if. The rest of the
| body of the function, and its closing brace, are outside the
| snippet included in the article.
| Jedd wrote:
| Ah, thanks - I'd missed that.
| wizzwizz4 wrote:
| It comments out the `if` block, but not the rest of the
| function.
| alexwasserman wrote:
| Snippet supplied in the article: function
| get($urlPath, $queryParams=null, $ouputFormat='xml'){
| // if(!authenticateAsOwner($queryParams)) // { //
| header("HTTP/1.0 401 Unauthorized"); // return; //
| }
|
| That if statement is checking for authentication before running
| the rest of the function. Just the if check is commented out.
|
| Assuming here the rest of that function would come below it,
| with a closing brace.
|
| ie: function get($urlPath, $queryParams=null,
| $ouputFormat='xml'){ //
| if(!authenticateAsOwner($queryParams)) // { //
| header("HTTP/1.0 401 Unauthorized"); // return; //
| } do; something; here; then;
| }
| Sanzig wrote:
| The commented-out closing brace is for the if statement, not
| the whole function. The rest of the function was snipped, you
| can see the whole thing here:
| https://paste.debian.net/plainh/7630c424
| [deleted]
| ALittleLight wrote:
| I would've thought that destroying your users' data in vast
| amounts would be bad for the company. Surely this would shatter
| user trust? Who would buy something like this from Western
| Digital in the future?
|
| And yet, their stock price seems unaffected. It was slightly up,
| though just in the way it randomly fluctuates, on the day of the
| announcement.
| throwawayboise wrote:
| It's a defect in an old product that they don't sell or even
| support anymore. They are still selling hard drives by the
| millions to server and storage OEMs. Consumers mostly are not
| even buying spinning drives anymore. It's all Flash or SSD.
| dehrmann wrote:
| > Consumers mostly are not even buying spinning drives
| anymore. It's all Flash or SSD.
|
| On one hand, they own Sandisk. On the other, no one outside
| of the industry knows that.
| genghizkhan wrote:
| Why would someone comment out authentication for reset? I mean,
| what possible reason is there for doing so? It doesn't make
| security any better and it's not something which impacts day-to-
| day performance in any way.
| prirun wrote:
| If one of these devices is sold, the new owner may want or need
| to do a reset but doesn't know the password.
| genghizkhan wrote:
| There exists a physical reset pinhole button on these
| devices.
| sgerenser wrote:
| If a user forgets their password, they still need a way to
| factory reset so as not to brick the device. Of course, this
| should involve, say pressing and holding physical button on the
| device. Just commenting out the password check was probably a
| lot easier.
| genghizkhan wrote:
| Afaik these devices do have a physical reset pinhole button.
| tyingq wrote:
| Guessing this is right. While neither would be perfect, they
| could have at least checked for "request coming from the same
| local subnet" or "enter MAC address as password", or similar.
| bellyfullofbac wrote:
| The most infuriating answer would be maybe they were testing
| the restore function, and was tired of entering the test
| username and password over and over again. And then the "I'll
| just comment it out for my tests" got commited, and built, and
| deployed.
| spideymans wrote:
| Was likely done in development by a developer that was sick of
| seeing the same password prompt 50 times a day, and who later
| forgot to un-comment it. There's absolutely no way this should
| have made it past code review.
| theropost wrote:
| Ouuf, I was wondering what happened to all my data on my old My
| Book live - I'm okay with my own incompetence or network
| security, however I'm not okay with WD's incompetence
| gentleman11 wrote:
| I have 2 backups of most data but these stories make me worry.
| It is so time consuming. Easy to forget to maintain, & test.
| vxNsr wrote:
| Just curious, did you have remote (WAN) access set up?
|
| I have one of these at my parents house, I had them unplug it,
| once I read this, but I was always wary of turning on remote
| access, as in it would only be accessible from the LAN, I
| haven't had a chance to go back in and check if it was hit, but
| I'd like to think that without remote access turned on it
| wasn't vulnerable.
| tyingq wrote:
| A post with pretty deep detail:
| https://censys.io/blog/cve-2018-18472-western-digital-my-boo...
| flatiron wrote:
| first HN article had a bunch of people saying there were
| devices behind a NAT with no port forwarding that had the
| issue, this doesn't describe what happened there (if that
| actually happened)
| tyingq wrote:
| Maybe UPNP?
| flatiron wrote:
| yer prolly right. whats more 2021 than hard drives with
| upnp putting themselves on the WAN with commented out auth
| on the factory reset API?
| fullstop wrote:
| I wonder if they were looking for wallet.dat files?
| racl101 wrote:
| Can anyone clarify?
|
| Is this a vulnerability of all My Book drives or just ones that
| connect to a cloud / online service?
|
| I have one of these but haven't plugged it in for a while.
| However, I don't remember using any online service with it. It
| just had a bunch of movies.
| ayngg wrote:
| It applies to the "My Book Live" version.
| mikeho1999 wrote:
| I'd love to take a moment to talk about the quality of the code
| (assuming that the full code listing that the Ars article links
| to is accurate).
|
| It's pretty clear that there are no coding standards, sparse
| comments (literally just 1), lots of mixed tab/spacing,
| misspelled names, etc.
|
| Furthermore, the fact that this got into production shows that
| either the code wasn't even reviewed prior to release and/or it
| wasn't reviewed carefully.
|
| I think this goes to a much larger issue of devices in this so-
| called IoT world we live in now. So many of these devices are
| built by "hardware-first" companies, who oftentimes put very
| little budget, time or emphasis on the software side of things.
| As people's daily lives depend more and more on IoT devices, I
| think this should be more and more of a concern: it doesn't
| matter how good the hardware is and/or how cost efficient a
| company's hardware production capability is if you don't value
| the quality in the software that runs said hardware.
|
| (Full Disclosure: I'm a full-time independent software developer
| who has worked on many IoT projects, working directly with
| hardware and device manufacturers)
| tibbydudeza wrote:
| Usually a OEM does a proof of concept cobbled together linux
| based firmware to demo the capability of it's new SOC to
| prospective buyers.
|
| WD then takes the OEM POC firmware - slaps on their logos and
| ships it.
|
| That is why I would trust NAS manufacturers like Synology or
| Thecus or QNAP more -personally I use Unraid.
| res0nat0r wrote:
| You'd likely be shocked/scared at the amount of terrible code
| which is out there in the wild running at any time in large
| companies. Mostly it is outsourced to the cheapest possible
| vendor, many times who have barely a grasp of what they're
| doing, and for sure don't understand or think about best
| security practices.
| alpha_squared wrote:
| Several years back, I did an internship at Western Digital. I
| was a software intern on a hardware team in testing working on
| a project that no one on the team was capable of doing. It
| quickly became obvious it was more appropriate for a contractor
| to build than an intern, and was even told as much, but they
| went with the intern route because it "required fewer
| signatures".
|
| It was glaringly obvious that software was not part of the
| company's core competency. Worse, was that software was treated
| as a nuisance and afterthought to the hardware. No idea how
| today's Western Digital compares, but I generally steer clear
| of the company's products that rely on any non-trivial
| software.
| Sanzig wrote:
| I think part of the problem is that the industry doesn't seem
| to value embedded software engineers. The work embedded
| software folks do is just as complicated as that of a full-
| stack developer working for a SaaS company, but the salaries
| aren't comparable.
|
| It doesn't help things that the skill sets are very
| transferrable. It's tough to find somebody willing to forego
| 20-30% of salary just because they enjoy embedded - after a
| while, people get fed up and move into better paid SE roles.
| So, embedded software departments are often short-handed. A
| former employer of mine lost a senior firmware engineer almost
| three years ago. As far as I know, they still haven't filled
| the position.
| shortformblog wrote:
| This is probably also reflected by the fact that they stopped
| patching it relatively early in its life. Three years of
| patches for what is effectively an internet-connected hard
| drive, presumably one that its target audience is going to be
| using for many years as something that "just works," reflects a
| disinterest by Western Digital in living up to its own sales
| pitch.
| tibbon wrote:
| Right - if the hardware is no longer selling (due to missing
| sales targets) then there's little incentive for the
| companies to still invest significant resources into
| maintaining it. Of course one option would be to open source
| it entirely and turn it over the community for long term
| support, but the companies like holding onto whatever little
| bits of IP they can (even if they are largely just
| implementing open source software to begin with, and nothing
| super speceial).
|
| This is a problem. I don't know the solution, except that
| companies should really commit to LTS support of things no
| matter the sales targets.
| mschuster91 wrote:
| > This is a problem. I don't know the solution, except that
| companies should really commit to LTS support of things no
| matter the sales targets.
|
| The EU and US could mandate that all products sold in the
| EU/US have their firmware source code, working toolchain as
| a virtual machine image and all relevant documentation
| (including SoC docs, BOM and schematics, as well as case
| and other parts' 3D specs and any digital certificates and
| private keys) be held in trust at the national public
| libraries. When the manufacturer ceases to support the
| device - including not fixing critical security bugs at 90
| days post disclosure - the complete archive is released to
| the public as open source.
|
| Additionally, the US and EU could mandate that any Internet
| connected device's firmware _as well as its development
| process_ must pass an audit at certified organizations such
| as TUV or UL. We 're doing this for electrical and gas
| appliances already due to the risk these things pose to the
| general public, it's time to do the same for IT.
|
| Products developed as open source can be exempted from the
| audit requirement to incentivize open source development.
| beerandt wrote:
| I've had similar ideas, but with IP/DMCA
| rights/enforcement being conditional on depositing keys
| and source code with the Library of Congress, to hold in
| a sort of public escrow. Maybe even require it for FCC
| certification, or for courts to to recognize/enforce
| EULAs or other claims.
|
| If you want to enjoy the public protections of IP, the
| public needs to get a copy of source code and meaningful
| device access, upon whatever definition of un-patched
| software or device abandonment.
|
| Obviously there's a lot to work out, but philosophically,
| I like the idea better than introducing new jurisdictions
| of regulatory power, especially when the relief sought
| should already be attainable under the public contract
| made in seeking government enforced IP protection.
| eqvinox wrote:
| > Abdine has come up with a plausible theory--that one hacker
| first exploited CVE-2018-18472 and a rival hacker later exploited
| the other vulnerability in an attempt to wrest control of those
| already compromised devices.
|
| Excluding straight vandalism, I can't really come up with another
| reason for the reported sequence of events. Presumably the first
| attacker wanted to build a botnet (which is actually something
| they can draw profit from), and a competitor wanted to prevent
| them from doing that.
|
| Otherwise -- again, excluding straight vandalism -- what is the
| benefit of wiping the devices? Having your preexisting botnet
| target/scan and exploit these devices isn't free. What else could
| they have been trying to gain?
| shadilay wrote:
| Incompetence probably, there's really no downside when
| experimenting with others' devices (aside from legal).
| eli wrote:
| and moral
| totally wrote:
| and ethical
| shadilay wrote:
| I think it's a given that the WD hackers are neither
| ethical nor moral.
| dannyw wrote:
| A put option on WD stock?
|
| Realistically speaking, you are probably going to be able to
| hide ~$100-$250k of put earnings, especially if you have a
| trading history and it's not the only thing you trade.
|
| That can be a considerable payout.
| frakkingcylons wrote:
| I think the bigger question is whether the attack will
| actually move the stock in the direction you want.
| dannyw wrote:
| Ok, buy the same number of puts and calls, so your exposure
| is to volatility (vega). This way, it can move in any
| direction and you'd benefit, and it's very unlikely a big
| scary hacking event (covered by the financial press)
| wouldn't increase volatility of a stock.
| pydry wrote:
| Bizarrely it doesnt seem to have:
|
| https://www.marketwatch.com/investing/stock/wdc
| tedunangst wrote:
| The stock market just doesn't care about the same things
| HN thinks are ultra critical.
| charwalker wrote:
| IIRC Doge is one of the top 3 best performing assets in
| 2021.
|
| Does HN like Doge? I helped use it to send Jamaica to the
| Olympics in 2014...
| throwaway09223 wrote:
| Yup. I learned long ago that having an insider's
| perspective doesn't necessarily help me predict where the
| market will move.
|
| An expert's perspective can certainly be helpful, but if
| market prices are set by non-experts (or, experts in
| other fields) then it may just lead to consistently wrong
| answers per the tenets of keynesian economics.
| pydry wrote:
| Probably partly because literally half the market is
| passive investors who dont react to any news.
| marcosdumay wrote:
| Like the device a company sells actually working at
| all...
|
| I'm not disagreeing by the way. You are correct. And the
| stock traders probably made the correct guess about the
| company profits.
| frakkingcylons wrote:
| I don't doubt your options strategy, but this didn't move
| the market for WD at all because it's ultimately small
| time news compared to everything else happening.
| tgragnato wrote:
| Or the botnet was DDoSing, and someone decided they had enough.
| (it would not be the first time)
| oneweekwonder wrote:
| reminds me of the time(2018) outdated MikroTik routers got
| patched by a grey-hat[0].
|
| [0]: https://www.zdnet.com/article/a-mysterious-grey-hat-is-
| patch...
| tyingq wrote:
| Watching the world burn. There are plenty of examples of
| worms/viruses that bring no benefit to the creator. I know you
| said "excluding", but it's popular.
|
| Alternatively, some misguided "white knight" idea. Maybe the
| factory reset turns off the "open to the internet" setting.
| sigzero wrote:
| Yup, some people just want to see the world burn.
| frombody wrote:
| What I don't get is why are people directly connecting these
| devices to the internet?
|
| The logs in the article show these devices being accessed from
| the internet.
|
| There have been many people in this forum mentioning how their
| data is gone, and I'm doubting most of the people here are
| directly connecting their devices to the internet .. which
| makes me feel like there is something more going on.
| 5555624 wrote:
| > What I don't get is why are people directly connecting
| these devices to the internet?
|
| Because they want to access their data from anywhere or at
| least like the idea of doing that and it's under their
| control, not the Google or Microsoft cloud.
| charwalker wrote:
| They don't trust or can't afford the monthly cost of _Drive
| cloud solutions so go with the home based solution. They
| still want the web access for pulling up photos for grandma
| or something.
|
| WD has (had?) credibility in non tech circles so these would
| sell well.
| iJohnDoe wrote:
| The developer probably commented out the authentication
| begrudgingly because he was requested to do so.
|
| If a user forgets their password or buys a used drive then they
| won't know the password. It's common in the hardware industry to
| be able to factory reset a device somehow.
| kova12 wrote:
| Or he just was working on a feature, and got annoyed with
| password prompts. Commented out authorization code, then forgot
| to comment it back in
| SketchySeaBeast wrote:
| And that's why the first person who performs the PR code
| review should be the person requesting it.
| MR4D wrote:
| > If a user forgets their password or
|
| Isn't this the reason for a hardware reset button?
|
| Having this available over the internet is probably negligent.
| beerandt wrote:
| How common is it now for a hardware button that isn't just
| dedicated input for software?
| mmis1000 wrote:
| At least 100% common for wifi routers? Not sure why all
| wifi routers have one though.
| MR4D wrote:
| Probably common, but connecting that function to the web
| (via PHP in this case) is pretty stupid.
|
| I would think it would run a firmware function to do the
| resetting, and if not that, then some sort of sell script
| that is not callable by their web interface.
|
| Due to all this stupidness, my weekend is going to be
| consumed by trying to find out if my Synology has something
| stupid in it (assuming I can even figure that out).
|
| So my trust in "personal" network storage devices has been
| shattered. Hopefully Synology is not as dumb.
| kova12 wrote:
| Just set up an old computer to be your nas and call it a
| day. Would be much quicker, and you can be much more
| confident it does only what you want it to do
| MR4D wrote:
| My son has my old computer for playing fortnight. :)
|
| So I'm reading up on TrueNAS to see if that's the way for
| me to go.
|
| Frankly, I love my Synology, but it at EOL (can't do the
| new version of DSM) but my needs are pretty simple, hence
| either straight Linux or TrueNAS seem to be my best
| options.
| beerandt wrote:
| I tried to start implementing separate lans/vlans at home
| for trusted and untrusted devises. But quickly realized I
| don't really trust any of it, save my personal laptop and
| a few of the servers I run.
| kova12 wrote:
| ... and after a while, when you realize the hole goes
| deeper, you stop trusting these as well
| beerandt wrote:
| It's pretty much devolved to users instead of devices:
|
| 1) devices only I have write access to 2) devices others
| have access to 3) iot (which are basically users I've
| never met)
|
| At least I can segregate me running a port scan from my
| laptop, to a family members phone running a portscan from
| some spyware game they downloaded.
|
| I have a good idea _how much_ I can trust my own devices,
| even if my phone 's baseband OS is sending an unstoppable
| stream of location data and super cookies.
|
| But this NAS/cloud connected storage thing is a bit of a
| oddball, since you're supposed to trust it with your
| data, but can't trust it with unfettered network access.
| thujlife wrote:
| intel/amd me running second own os on everything. One
| malicious lib, GG security theatre.
| Osiris wrote:
| I read the support thread on WDs website and someone
| mentioned doing a hardware reset using a button.
| johnnyApplePRNG wrote:
| I am kind of surprised they didn't ransomware them all.
|
| Is it not possible for some reason on these limited devices?
| pacman128 wrote:
| How would they contact the owner of the device? All they know
| is the IP address of the device.
| flatiron wrote:
| that's pretty simple. tar and encrypt all their data. put a
| DO_YOU_WANT_IT_BACK.TXT file in the root next to it and in
| there provide instructions to pay the ransom.
___________________________________________________________________
(page generated 2021-06-29 23:02 UTC)