Authentication for user [nobody] has FAILED

Legacy Products My Cloud OS 3
1

Has anyone seen this in the logs? I also noticed on my router someone from Sweden accessing port 80 on my NAS after I enabled to test latest updates. Maybe time to disable Cloud Access again.

“[LAN access from remote] from 193.105.134.220:53815 to 192.168.0.2:80, Sunday, Mar 27,2016 15:51:44”

1002×634 61.3 KB

2

Are you able to change the ports used by your unit?

3

Good question. I can via to Cloud Access, but the HTTP port will just be remapped and sent as plain text over the internet. I have again disabled the Cloud Access as I discovered more traffic from different parts of the world connecting via my router to port 80 (HTTP) to MCM.

I see 129.253.8.24 is owned by Western Digital. Why is there so much traffic from WD to the My Cloud device? The other addresses below are from the Netherlands, England, China, and Australia.

whois for the WD address
https://whois.arin.net/rest/net/NET-129-253-0-0-1

Attached Devices to the router

1579×164 10.9 KB

UPnP shows the two ports (80 - HTTP and 443 - HTTPS)

1637×295 10.7 KB

Shorten router logs
[LAN access from remote] from 129.253.8.24:52313 to 192.168.0.2:80, Friday, Apr 08,2016 23:40:34
[LAN access from remote] from 129.253.8.24:42480 to 192.168.0.2:80, Friday, Apr 08,2016 23:24:12
[LAN access from remote] from 129.253.8.24:19186 to 192.168.0.2:80, Friday, Apr 08,2016 23:07:52
[LAN access from remote] from 149.202.167.102:5002 to 192.168.0.2:80, Friday, Apr 08,2016 23:02:15
[LAN access from remote] from 129.253.8.24:60945 to 192.168.0.2:80, Friday, Apr 08,2016 22:51:28
[LAN access from remote] from {redacted home}:1333 to 192.168.0.2:443, Friday, Apr 08,2016 21:51:42
[LAN access from remote] from 104.156.240.216:45588 to 192.168.0.2:80, Friday, Apr 08,2016 21:51:17
[LAN access from remote] from 129.253.8.24:8726 to 192.168.0.2:80, Friday, Apr 08,2016 21:46:05
[LAN access from remote] from 209.132.203.187:50327 to 192.168.0.2:80, Friday, Apr 08,2016 21:44:59
[LAN access from remote] from 129.253.8.24:31272 to 192.168.0.2:80, Friday, Apr 08,2016 21:29:43
[LAN access from remote] from 129.253.8.24:64937 to 192.168.0.2:80, Friday, Apr 08,2016 21:27:36
[LAN access from remote] from 129.253.8.24:12776 to 192.168.0.2:80, Friday, Apr 08,2016 21:13:14
[LAN access from remote] from 129.253.8.24:5655 to 192.168.0.2:80, Friday, Apr 08,2016 20:56:53
[LAN access from remote] from 129.253.8.24:32085 to 192.168.0.2:80, Friday, Apr 08,2016 20:40:33
[LAN access from remote] from 129.253.8.24:43991 to 192.168.0.2:80, Friday, Apr 08,2016 20:07:51
[LAN access from remote] from 129.253.8.24:56711 to 192.168.0.2:80, Friday, Apr 08,2016 19:51:30
[LAN access from remote] from 129.253.8.24:38279 to 192.168.0.2:80, Friday, Apr 08,2016 19:35:09
[LAN access from remote] from 129.253.8.24:49914 to 192.168.0.2:80, Friday, Apr 08,2016 19:30:59
[LAN access from remote] from 129.253.8.24:27724 to 192.168.0.2:80, Friday, Apr 08,2016 19:14:38
[LAN access from remote] from 169.229.3.90:42332 to 192.168.0.2:80, Friday, Apr 08,2016 19:09:48
[LAN access from remote] from 169.229.3.90:33382 to 192.168.0.2:80, Friday, Apr 08,2016 19:09:48
[LAN access from remote] from 218.22.211.69:33290 to 192.168.0.2:80, Friday, Apr 08,2016 19:03:15
[LAN access from remote] from 129.253.8.24:1678 to 192.168.0.2:80, Friday, Apr 08,2016 18:58:18
[LAN access from remote] from 129.253.8.24:58329 to 192.168.0.2:80, Friday, Apr 08,2016 18:41:58
[LAN access from remote] from 93.174.93.94:52011 to 192.168.0.2:80, Friday, Apr 08,2016 18:40:04
[LAN access from remote] from 129.253.8.24:56798 to 192.168.0.2:80, Friday, Apr 08,2016 18:25:36
[LAN access from remote] from 129.253.8.24:8326 to 192.168.0.2:80, Friday, Apr 08,2016 18:09:15
[LAN access from remote] from 129.253.8.24:43074 to 192.168.0.2:80, Friday, Apr 08,2016 17:52:53
[LAN access from remote] from 129.253.8.24:19065 to 192.168.0.2:80, Friday, Apr 08,2016 17:36:31
[LAN access from remote] from 185.25.151.159:49864 to 192.168.0.2:80, Friday, Apr 08,2016 17:31:05
[LAN access from remote] from 129.253.8.24:59150 to 192.168.0.2:80, Friday, Apr 08,2016 17:20:10
[LAN access from remote] from 93.174.93.94:52011 to 192.168.0.2:443, Friday, Apr 08,2016 17:11:28
[LAN access from remote] from 129.253.8.24:61226 to 192.168.0.2:80, Friday, Apr 08,2016 17:03:49
[LAN access from remote] from 129.253.8.24:34851 to 192.168.0.2:80, Friday, Apr 08,2016 16:47:28
[LAN access from remote] from 129.253.8.24:26016 to 192.168.0.2:80, Friday, Apr 08,2016 16:31:08
[LAN access from remote] from 129.253.8.24:23191 to 192.168.0.2:80, Friday, Apr 08,2016 16:14:47
[LAN access from remote] from 129.253.8.24:63776 to 192.168.0.2:80, Friday, Apr 08,2016 15:58:25
[LAN access from remote] from 129.253.8.24:22945 to 192.168.0.2:80, Friday, Apr 08,2016 15:42:04
[LAN access from remote] from 129.253.8.24:27575 to 192.168.0.2:80, Friday, Apr 08,2016 15:25:43
[LAN access from remote] from {redacted work}:1760 to 192.168.0.2:443, Friday, Apr 08,2016 13:39:37
[LAN access from remote] from {redacted work}:1743 to 192.168.0.2:443, Friday, Apr 08,2016 13:38:57
[LAN access from remote] from {redacted work}:1725 to 192.168.0.2:443, Friday, Apr 08,2016 13:38:56
[LAN access from remote] from {redacted work}:1724 to 192.168.0.2:80, Friday, Apr 08,2016 13:38:55
[LAN access from remote] from {redacted work}:1723 to 192.168.0.2:80, Friday, Apr 08,2016 13:38:55