Re: Security News This Week: Hackers Are Erasing Western Digital Hard Drives Remotely

Frank Slootweg wrote:
> Mayayana <[email protected]> wrote:
> 
> [Nearly all deleted.]
> 
>>   I knew you'd be back to argue this. :) But you're shooting the
>> messenger. There are reasons to allow remote access, as I said,
>> but there are also risks. You don't do yourself any favors by blaming
>> my imagined paranoia for those risks.

> 
>   Also - 'between the lines' - you seemed to be blaming WD for their
> customers losing their data.

This article describes the situation as doubly-hilarious.

It's suspected two groups or two individuals were involved,
one initially establishing a botnet made from the WD device,
and a second one using the factory reset vulnerability, to
shut the devices down. It's like you were on your way to the
7-11 convenience store, and get caught in gang crossfire :-)
Oops.

https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bug-to-mass-wipe-my-book-live-devices/?comments=1

Now, this is my kind of code. The double-slashes, comment
out the authentication call. It makes you wonder whether
all devices have this code or not.

function post($urlPath, $queryParams = null, $ouputFormat = 'xml') {
     // if(!authenticateAsOwner($queryParams))
     // {
     //      header("HTTP/1.0 401 Unauthorized");
     //      return;
     // }

   Paul