Re: Security News This Week: Hackers Are Erasing Western Digital Hard Drives Remotely

Paul <[email protected]> wrote:
> Frank Slootweg wrote:
> > Mayayana <[email protected]> wrote:
> > 
> > [Nearly all deleted.]
> > 
> >>   I knew you'd be back to argue this. :) But you're shooting the
> >> messenger. There are reasons to allow remote access, as I said,
> >> but there are also risks. You don't do yourself any favors by blaming
> >> my imagined paranoia for those risks.
> 
> > 
> >   Also - 'between the lines' - you seemed to be blaming WD for their
> > customers losing their data.
> 
> This article describes the situation as doubly-hilarious.
> 
> It's suspected two groups or two individuals were involved,
> one initially establishing a botnet made from the WD device,
> and a second one using the factory reset vulnerability, to
> shut the devices down. It's like you were on your way to the
> 7-11 convenience store, and get caught in gang crossfire :-)
> Oops.
> 
> https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bug-to-mass-wipe-my-book-live-devices/?comments=1
> 
> Now, this is my kind of code. The double-slashes, comment
> out the authentication call. It makes you wonder whether
> all devices have this code or not.
> 
> function post($urlPath, $queryParams = null, $ouputFormat = 'xml') {
>      // if(!authenticateAsOwner($queryParams))
>      // {
>      //      header("HTTP/1.0 401 Unauthorized");
>      //      return;
>      // }
> 
>    Paul

  Ah, the story has changed quite a bit! Apparently there *was* already
an unfixed vulnerability, which allowed hackers to obtain full access,
if they knew the IP address of the device.

  That vulnerability is CVE-2018-18472, which says:
<https://nvd.nist.gov/vuln/detail/CVE-2018-18472>

"Current Description

 Western Digital WD My Book Live and WD My Book Live Duo (all versions)
 have a root Remote Command Execution bug via shell metacharacters in
 the /api/1.0/rest/language_configuration language parameter. It can be
 triggered by anyone who knows the IP address of the affected device, as
 exploited in the wild in June 2021 for factory reset commands,"

  So - without having to have/know any authentication information (i.e.
username, password) - hackers *could* already *fully* control the
device. The device-wipe (factory reset) - without the need for
*additional* authentication - was just icing on the cake.

  So this was/is an unfixed 0-day vulnerability for a device for which
support ended in 2015.

  This in an example of the risks of continuing to use out-of-support
hardware/software. Don't get me wrong, I don't blame the users for doing
that, because often it's not feasible to throw away all 'old' stuff and
buy 'new' and start the cycle all over again. It's just a very
unpleasant reminder.

  What is not clear from the Ars Technica article, nor from the CVE, is
whether or not the user had to have enabled the "personal cloud"
functionality in order to be vulnerable. I.e. even if the hackers knew
the IP address of the device, could they penetrate from the WAN side of
the router to the LAN side if the "personal cloud" functionality was
*not* enabled? I don't think so, but sofar the articles/reports have
been unclear about this aspect. (Again, I'm not blaming the users if
they used this functionality, I'm just wondering if the vulnerability
affects *all* devices or 'only' those with "personal cloud" enabled.)