Western Digital My Cloud drives have a built-in backdoor - Page 1
Forum section: electronics / general

author: BravoV
author_rank: Super Contributor
timestamp: January 06, 2018, 12:21:54 pm
content: Source ->https://www.techspot.com/news/72612-western-digital-cloud-drives-have-built-backdoor.htmlQuoting ....More troubling is the existence of a hard coded backdoor with credentials that cannot be changed. Logging in to Western Digital My Cloud services can be done by anybody using "mydlinkBRionyg" as the administrator username and "abc12345cba" as the password. Once logged in, shell access is readily available followed with plenty of opportunity for injection of commands.

author: Decoman
author_rank: Regular Contributor
timestamp: January 06, 2018, 02:25:12 pm
content: Wow, I am not familiar with this, but seeing the phrase "Remote access of files is possible" sounds pretty terrible at least.I am reminded of this other thing that WD was known for, some years back. Something about built in DRM protection on their NAS stuff iirc. Sadly I've forgotten the details. I think it was about how only DRM protected media files was allowed to be stored on the NAS harddrive(s) if I remember it correctly.

author: TopLoser
author_rank: Unknown
timestamp: January 06, 2018, 03:09:19 pm
content: To be fair though this backdoor only affects firmware versions < 1.06 and was fixed in July 2015?https://www.exploit-db.com/exploits/43434/

author: wraper
author_rank: Unknown
timestamp: January 06, 2018, 03:17:17 pm
content: Quote from: TopLoser on January 06, 2018, 03:09:19 pmD-link was fixed but WD was nothttp://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125EDIT:Quote

author: TopLoser
author_rank: Unknown
timestamp: January 06, 2018, 03:23:48 pm
content: Quote from: wraper on January 06, 2018, 03:17:17 pmBugger! The world is a dangerous place...

author: wraper
author_rank: Unknown
timestamp: January 06, 2018, 03:28:25 pm
content: Nice:Quote

author: Cyberdragon
author_rank: Super Contributor
timestamp: January 06, 2018, 04:20:10 pm
content: What a noob password...What's more troubling is that people published the access codes...THANKS...jk...

author: cloudscapes
author_rank: Regular Contributor
timestamp: January 06, 2018, 06:14:12 pm
content: Blocked my WD cloud from accessing the internet via router for now. Thanks for the heads up.Slowest clap ever. Thanks WD. Some people really are garbage at their jobs. Or, quite possibly, people are doing their jobs, because someone might have thought this was a good idea.

author: james_s
author_rank: Super Contributor
timestamp: January 06, 2018, 06:42:25 pm
content: This is precisely the sort of reason I tend to avoid anything with "cloud" in the name, certainly when it comes to any sort of data I would not deliberately put out there for people to grab.

author: floobydust
author_rank: Super Contributor
timestamp: January 06, 2018, 08:09:31 pm
content: TheWD Community forumshave firmware bugs and issues raised, but I did not see much if any responses or fixes from WD.I think WD wanted to go beyond HDD's and make consumer products, but their firmware and support is pretty awful. It looks farmed out, distant from the users with real concerns.Synology is more expensive but their regular S/W updates are really good. Not a toy NAS.