After hackers wiped many of Western Digital's My Book Live devices, a look at the code suggests the manufacturer had removed authentication code
Ars TechnicaDan Goodin
Context & Ripple Effects
Western Digital initially characterized the My Book Live incidents as malware-driven factory resets and said it did not believe its servers had been breached. The subsequent reports of erased My Book Live data established the immediate harm; the code review now redirects attention from a generic compromise toward the device firmware's access controls.
First-order effects
My Book Live owners face a more concrete explanation for the wipes: an authentication check appears to have been removed, putting the affected firmware at the center of the incident.
Western Digital must account for a security-sensitive firmware change rather than only its earlier assessment that its servers were not compromised.
Second-order effects
The finding raises the support and recovery burden for Western Digital and affected owners because a factory reset destroys the data the device was meant to retain.
Other connected-storage vendors face sharper scrutiny of firmware changes that alter authentication, especially where customers depend on devices for local data retention.
Third-order effects
If code-level reviews continue to identify removed access controls after destructive incidents, firmware change management becomes a product-trust issue rather than an internal engineering detail.
The trend: Connected-device security is shifting toward scrutiny of firmware-level access-control decisions after failures expose customers to irreversible data loss.
This was *excellent* technical reporting by @dangoodin001, who may have just figured out how hackers were mass-wiping Western Digital storage devices. https://arstechnica.com/...
@trycatchhcf
@trycatchhcf on x
“according to the vulnerable code itself, a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed.” https://arstechnica.com/...
@dangoodin001
Dan Goodin on x
I updated the My Book Live article to report that Western Digital will provide data recovery services, starting next month. The company also said that the 0day was introduced in 2011 “as part of a refactor of authentication logic in the device firmware.” https://arstechnica.com/.…
@howelloneill
Patrick Howell O'Neill on x
As usual, when it comes to the technical journalism, Dan is in another league Side note, this is fairly insane? https://twitter.com/...
@dabdine
Derek Abdine on x
We've updated our research with more details on the campaigns going on against My Book Live devices, including a firmware analysis that shows a newly undisclosed vulnerability that can trigger the factory restore process without authentication: https://censys.io/...
@campuscodi
Catalin Cimpanu on x
In a report yesterday, Censys said it believes the threat actor who wiped WD NAS devices last week also used a zero-day, not just CVE-2018-18472, as WD claimed https://censys.io/... https://twitter.com/...
@dancow
Dan Nguyen on x
this is why i always put “TK” or “TODO later ;)” every time I comment out a whole block of vital code that I'm too lazy/tired to fix at the moment https://twitter.com/... https://twitter.com/...
@bergmayer
John Bergmayer on x
WD should be subject to company-threatening liability for this. Only way to create the right incentives https://arstechnica.com/...
@hypninfosec
@hypninfosec on x
“a Western Digital developer actively removed code that required a valid user password before allowing factory resets to proceed” :| https://arstechnica.com/...
@dangoodin001
Dan Goodin on x
Hackers exploited 0-day, not 2018 bug, to mass-wipe My Book Live devices https://arstechnica.com/...