A second exploit has emerged in the sad WD My Book Live data deletion saga
1Reported today on The Verge
For the full article visit: https://www.theverge.com/2021/6/29/22555959/wd-my-book-live-second-exploit-authentication-factory-reset-without-password-root-control
Reported today in The Verge.
A second exploit has emerged in the sad WD My Book Live data deletion saga
It looks like there may have been more than one exploit used to cause the mass deletion of data from WD My Book Live NASes last week, according to a report from Ars Technica. When news broke that people were finding that their data was missing, some (including WD itself), pointed to a known exploit from 2018, which allowed for root access of the device. However, it appears as though there's more going on than was initially suspected.
If you have one of these devices, you should unplug it from the internet before reading any further - it's clear at this point that your data is at risk if the device is online.
The second exploit, reported by Ars Technica, doesn't give an attacker full control over the device like the other exploit. It just allows them to remotely wipe the device without having to know the password. Tragically for those who lost data, it seems that code that would've prevented this was actually present in the WD My Book Live's software, but it appears to have been commented out (or deactivated) by WD at some point - because of this change, the software didn't run authentication when asked to do a factory reset.
WD had stopped supporting these devices in 2015. While the exploit has been around since at least then, it's not necessarily a scenario where an obvious security issue persisted through years and years of updates. The question still remains, though, as to why hackers decided to factory reset the devices.
Ars Technica has a wild theory, based on analysis by security firm Censys: the data deletion happened as the result of a fight between hackers, with one botnet owner potentially trying to take over or disrupt another's. One hacker (or group of