Western Digital My Cloud drives have a built-in backdoor

[BravoV]

Source -> https://www.techspot.com/news/72612-western-digital-cloud-drives-have-built-backdoor.html

Quoting ....

More troubling is the existence of a hard coded backdoor with credentials that cannot be changed. Logging in to Western Digital My Cloud services can be done by anybody using "mydlinkBRionyg" as the administrator username and "abc12345cba" as the password. Once logged in, shell access is readily available followed with plenty of opportunity for injection of commands.

 

[Decoman]

Wow, I am not familiar with this, but seeing the phrase "Remote access of files is possible" sounds pretty terrible at least.

I am reminded of this other thing that WD was known for, some years back. Something about built in DRM protection on their NAS stuff iirc. Sadly I've forgotten the details. I think it was about how only DRM protected media files was allowed to be stored on the NAS harddrive(s) if I remember it correctly.

[TopLoser]

To be fair though this backdoor only affects firmware versions < 1.06 and was fixed in July 2015?

https://www.exploit-db.com/exploits/43434/

[wraper]

To be fair though this backdoor only affects firmware versions < 1.06 and was fixed in July 2015?

https://www.exploit-db.com/exploits/43434/

D-link was fixed but WD was not
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125
EDIT:

It should be noted that unlike the WDMyCloud the D-Link DNS-320L is
currently NOT vulnerable to the backdoor and file upload issues, so you
should upgrade your DNS-320L firmware as soon as possible as the issues can
be leveraged to gain a remote root shell on the DNS-320L if you are not up
to date with your device firmware. The backdoor was first removed in the
1.0.6 firmware release. (July 28, 2014)

[TopLoser]

To be fair though this backdoor only affects firmware versions < 1.06 and was fixed in July 2015?

https://www.exploit-db.com/exploits/43434/

D-link was fixed but WD was not
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

Bugger! The world is a dangerous place...

[wraper]

Nice:

The backdoor has been published by James Bercegay, with GulfTech Research and Development, and was disclosed to Western Digital on June 12th 2017. However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue.

[Cyberdragon]

What a noob password...

What's more troubling is that people published the access codes...

THANKS...

jk...

[cloudscapes]

Blocked my WD cloud from accessing the internet via router for now. Thanks for the heads up.

Slowest clap ever. Thanks WD. Some people really are garbage at their jobs. Or, quite possibly, people are doing their jobs, because someone might have thought this was a good idea.

[james_s]

This is precisely the sort of reason I tend to avoid anything with "cloud" in the name, certainly when it comes to any sort of data I would not deliberately put out there for people to grab.

[floobydust]

The WD Community forums have firmware bugs and issues raised, but I did not see much if any responses or fixes from WD.

I think WD wanted to go beyond HDD's and make consumer products, but their firmware and support is pretty awful. It looks farmed out, distant from the users with real concerns.

Synology is more expensive but their regular S/W updates are really good. Not a toy NAS.