KUPIDON Ransomeware

My Cloud OS 3 Personal & Network Attached Storage My Cloud
21

^- - - -which is why I have nearly ZERO data on my PC’s. . . and the NAS units are backed up to non-connected drives.

I find myself once again debating the siren call of web connections into the units. . . .but between THIS thread and the INDEXING thread that is currently being discussed. . . . I am thinking one needs to either “roll your own” with a PC and VPN; or commit to a public service like DropBox or OneDrive.

1 Like
22

Not sure what kind of “solution” you were looking for, but the solution is to wipe the unit and restore data from a clean backup. Even if there was a one click solution to unlock the encrypted files there is no guarantee the malware/virus isn’t still lurking around somewhere on your local network just waiting to reinfect the My Cloud. That’s why the only way to be sure is to wipe the device and reload the data from a backup.

Don’t think its been determined exactly how people’s My Cloud’s are being infected. Is the firmware itself being compromised to run the malware/virus from the root level? Is it from just having one Public Share? Is it from the Remote Access feature? Is it from SSH being enabled? Is it from another local network device being infected? Was it due to someone opening up an infected email or infected webpage or infected file they downloaded? Is it due to one’s local network security being compromised? Etc.

As has been indicated above there are ways (using SSH) to try and disable or remove the default Public Share on a single bay/single drive My Cloud which cannot currently be changed to Private through the My Cloud Dashboard.

1 Like
23

@Bennor Your response was much nicer than the blunt , harsh response I provided.

24

Same issue except, I have not connected my Mac to my MyCloud EX2 in over 2 years. The Kupidon appeared on Aug 28, 2020. My last connect to EX2 hardline or wireless was in May 2019. I only have photos on it which I already have in another drive from years back. I can simoky toss the drives and install new drives, but won’t as EX2 is no longer supported. I’m not even sure if EX2 Ultra is even supported anymore. Thus, I can only assume the ransomware got through via the internet. I have a router that connects to a switch. Off the switch runs to Samsung TV, to Xbox and to MyCloud. I haven’t uploaded any photos to the EX2 since May 2019 and that was from my Note 9 phone: 10 photos.

26

Marry Me! I’m right there with you. You’re intimations are correct. The initial draw into WD cloud devices and notably, the EX2 when it first was launched was for those traveling to be able to remote in to show photos, documents, etc. on their phone, tablet, etc. I still have the original WD Photos app, which is not on the app store anymore. I simply transfer apps from old phone to new when I get new phones and the WD Photo app transfers over; thus still get the nice photo album library. Yet, as you note, once you open the cloud to the internet, anything can happen and again you’re correct; WD security is not strong. I don’t like cloud-based services as I’ve had data lost, even on Apple’s iCloud. I do backup drives also, and not really too much work as I add to my backups regularly; take photos, download photos to drive weekly. What I never liked about the EX2 was that when you move photos onto the drive(s), they images are reduced to micro size and you cannot pull them off those drives as original full size.