RoofingGuy wrote:
Well, you saw how well WD’s “please don’t distribute this…” has worked with the other firmwares… they were posted (and re-hosted) everywhere within minutes of WD emailing the links out.
People appear to just be so desperate to have the mkvmerge issue “fixed”, that they’ll do anything… well, anything aside from avoiding piracy or re-muxing the affected files themselves, it appears.
Which does open a large security hole. As you say, anyone with malicious intent can start posting new “firmwares,” and people will load them and distribute them without even giving it a moment’s thought.
There’s still the infamous instance of a legitimate WD update bricking boxes… I’d wait for a confirmed stable release before I just start clicking and installing the first thing I see. But I don’t think checksums (whether they end up as valid or not) will stop those who are desperate to have the latest beta – they’re not going to run the check anyways. They’ll just find the firmware somewhere and install it, and hope for the best.
Pretty much in agreement on all of the above. Couple of things:
Fixing the mkvmerge issues is undoubtedly part of the problem as relates to backchannel spread of beta firmware. However, my gut feeling is that a large part of it also comes down to WD’s lack of regular updates for the devices: people are basically anxious enough to get anything newer than firmware from last March that they’re taking a greater interest in the beta releases. The thing is, WD’s release and distribution methods aren’t conducive to receiving them in a controlled manner, which ultimately lead to the creation of the firmware ‘black market’ we’re seeing today. In a sense, it’s a vicious circle.
While some of this may be down to idle curiosity or early adopters doing what early adopters do, there is functionality that has been added in the betas over the last (almost) seven months which has never been packaged into a stable release. Using my position as an example, support for DVD menus is something that I definitely require in order to be able to view much of my media - without it, I can only see the first feature on the disc, which is a huge issue on discs that contain multiple features. But the only way to get that functionality at this time is to use beta firmware.
Related to checksums and distribution of malicious firmware: I completely agree that it will not completely stop the problem of someone releasing one that has been altered to be malicious; all the necessary ingredients are in place for one to be concocted and distributed. However, it will give an avenue by which integrity can be verified - so at the very least, a baseline as to what is an official release and what isn’t can be established. As things stand now, we can’t even reliably do that with firmware downloaded directly from WD: there’s no way to verify that, say, the 1.02.21 firmware downloaded today is the same as when it was posted on the 30th of March this year.
So yes, while I agree that the introduction of checksums into the distribution process is not the overall solution to the problems we’re seeing here, it will at least introduce a level of sanity to the process that is presently lacking. It’s definitely just one piece of a much larger puzzle, but a crucial one.
Your comment about the 1.01.12 update bricking units has me doing some tangental thinking, however. I’m almost tempted to start tearing into the firmware again and looking at the traffic generated during an update session to see if there’s a way to introduce a bogus (read: malicious) firmware to the unit… But I’m not overly-keen on doing my day job in an unpaid capacity during my free time. Maybe I’ll poke around in it a little, but the motivation to do so is quite honestly low.
