Help! All data in mybook live gone and owner password unknown

@Broccoli_Inspector yes, enabled

1 Like

I had UPnP enabled. I also had “Extended UPnP security” enabled, whatever that means.

Have now disabled UPnP for the time being (yes, I know, horses, stable doors etc…)

2 Likes

The flaw used to compromised the drives is nearly 3 years old at this point.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18472

It’s likely the script that wiped the drive was implanted on these WD devices a long time ago. Possibly to cover the tracks that the script was also uploading private data to hackers. For me that thought is more scary that wiped data.

Extended UPnP Security probably is the feature that allows UPnP clients to only add mappings to their IP. Unfortunately, as you already know, that feature is not helpful in this case. Its name is a misnomer. Even with it, UPnP is quite insecure. I’m glad you were able to disable it.

For those who haven’t been hit yet and shut down our devices in time but still need to use their My Book Live devices for backups, there should be a tutorial offered by WD to show how to keep the device only on the local network with proper firewall, etc. settings for common Internet modem/routers.

For WD to expect their customers to unplug their devices and have it sit like a brick for an extended period of time is unacceptable.

Or, is that what these devices are now? Worthless bricks?

2 Likes

ATTENTION! I HAVE MANAGED TO RECOVER MY FILES FROM MY WD MBL, FOR FREE!

(Sorry for caps, I just want to make sure people see this because I think it’ll work for most people.)

Disclaimers: Individual files have been recovered, but the original folder structure has not been restored. I have confirmed with .avi video files. Some file formats might not actually have been restored, I’m not entirely sure how files were redetected, whether the program actually restored each file block or recognized filetypes based on data patterns. The files were restored, however the names for the files and most other metadata were not.

Requirements:

  • A Windows PC (might work on Linux)

  • A spare disk (to recover your data, needs to hold all your prior data. If you are unsure how much storage is necessary, the program used will tell you how many GB of data was recovered.) (Make sure the disk is already formatted and mounted)

  • The ability to connect a 3.5" HDD into the PC (I used an external dock; internally plugging in via SATA should work as well)

  • https://www.diskinternals.com/linux-recovery/ (software used to recover the data)

  • Optional: https://diskinternals.com/linux-reader/ (lets you view ext format disks on Windows)

  • Time and patience
    What I did:

  • Installed the software I linked

  • Going thru the setup wizard

  • Select the WD MBL PARTITION (NOT the physical drive). The type should be ext3 or ext4.- The program will scan the partition. This step may recover a few files, but for me there was nothing found.

  • After the scan, on the top there will be a message with a button “recover more files”. Click that!

  • Select “full disk” scan, and select all the filetypes (or all the filetypes which you want to recover).

  • The program will rescan, showing you how many blocks/inodes it has found (part of the ext filesystem). When it’s done, you should see folders by file extension, containing the files.- Last, select any folders/files you want to save, and right click → save. Navigate to your spare disk, and then start saving.
    I had a bit more than a terabyte of data to recover, and as of now it’s predicted to take more than 2 days to recover the data to another network mounted storage drive I have. Once the program completes I’ll share what the result is if I remember.

10 Likes

Same here. I lost all of my data. Has anybody found a recovery method or should I lawyer up?

1 Like

Another update from the Repair Shop…

They’re seeing some success with the data recovery, but it’s still processing (it’s been running for about 5 hours and only at 68%). They’re going to keep plugging away, and I should know by Monday if it was successful.
They did indicate that they’re optimistic because knock wood they’re not seeing errors popup, it’s finding files, and it’s still running after all this time. They said they get concerned when error messages popup regularly and/or it shuts down completely after an hour or so. So fingers crossed we’ll have success on Monday!

1 Like

Norway here… Discovered this yesterday evening. Sent my MyBookLive to www.ibas.no immedeatly today. Around $300 just to look at it, and possibly $3000 to recover the data IF they can…

Anyone know how to send a support ticket to WD about this, and is it possible that they pay the cost???

Just checked my settings both UPnP & Extended UPnP are on I also noted recommendation you keep ‘Extended UPnP Security’ turned on to make sure your home network is secure. Seems to have been standard setting on upgraded router.
I think remote access was enabled
Auto update was enabled
All data appears lost

I had all cloud access disabled and my drive was wiped, through a barracuda firewall.

1 Like

Sorry to hear. Good reminder to everyone, if you don’t back it up, at some point you are going to lose it (no matter what equipment you use). Take it from personal experience.

1 Like

Anyone know how to send a support ticket to WD
about this, and is it possible that they pay the
cost???

For a device that is end of life since years? You‘re kidding. You missed to renew your hardware and to setup proper backups. Was it to expensive tho?

To make it easy for you not to pick the wrong brand:
If WD says ‚we take the data of our customer serious‘ then be informed: They don‘t.

@Jomusichn Check if UPnP was enabled please, and disable it if so.

Just some data from my end as I didn’t lose any data.

  • UPnP is enabled on my router
  • Remote access was enabled, but set to “manual” mode. I manually set up port forwarding on my router.
  • Auto Update was disabled
  • did not lose data
  • FTP Service was enabled
  • Didn’t change the device name
  • DID change the root password.
  • I’ve unplugged my My Book Live so I can’t check the firmware, but it was back from 2015 or 2016.
  • My router doesn’t respond to pings or anything on non-open ports.

Coincidentally I just recently backed up all the data on the drive to an external USB drive. It literally took nearly a week of continuous copying to do that. While the NAS is convenient, it was so slow as to nearly be unusable.

Prior to unplugging it, I checked my router and there were no outbound or inbound connections to the drive, which is how I like it. That’s one of the reasons I didn’t use “automatic” remote access.

On a side note, with “Automatic” remote access enabled, the drive may decide to use WD’s cloud servers are an access router. Even when set up manually, the drive maintains a DDNS which allows accessing the drive remotely by name. I feel I was just lucky that I didn’t get scanned by whomever did this.

1 Like

Didn’t work for me… Number of Files on both linux-Partitions was significant less than I had with Disk Genius. Also was very fast at scanning. Missed the movie files.

My Volumes just have 2 GB. That might be the reason why it’s so fast

I cant access usin 192.168.0.XX, not see UI.
anyone more?
Receive: ERR_CONNECTION_REFUSED

andyman, I think I am doing the same thing but…. after the Recovery programme has scanned I seem to have 4 Linux related drives.

  1. First is /dataVolume and is 1858.j71 Gb (my drive was a MBL 2Tb), it has Linux Ext under it.
  2. Second is given drive letter E: and is 489mb and has Linux Swap under it.
  3. Third is Linux Ext Volume 1 at 1.91Gb and Linux Ext under it.
  4. Fourth is Linux Ext Volume 2 at 1.91Gb and Linux Ext under it.

All other drives are NTFs or FAT32, probably other thumb drives etc through a USB hub.

Currently doing the initial basic scan of the Linux Volume 1.

I don’t see anything obvious that is called WD MBL Partition? Am I being stupid here??

Should I be scanning the Volume 1 and 2 with the deeper scan “recover more files” or am I wasting my time totally with these two volumes?? Thanks and good luck.

Thankfully I have not been affected as of yet. Drive is disconnected and following for updates. Pathetic that WD wouldn’t even do security updates on this device seeing as it’s always on and fully connected.

2 Likes

Same here. That’s why it was so fast and had so little hits