Samba vulnerability discovered. Actually not WD's fault

[SectorGZ]

@d_fens

this answer makes me wanna cry. I call this state “WDCry” ™

LOL … ain’t that the truth

[cpt_paranoia]

@WS64

That does not look as if WD even knows that they should act.

BTW, I’d strongly suggest you reply to this ‘support’ person, and point out that:

1. Their product is built using either a full version of Linux (Debian Wheezy) for v4 firmware, or cut-down version of Linux (BusyBox) for v2 firmware
2. Their product uses the Samba open source library to provide an SMB network file server
3. This is provided within their firmware image, created and supplied by WD, not some user-installed add-on
4. It’s their responsibility to fix it
5. If the ‘support’ doesn’t understand these points, they should pass the request on to someone who actually has a Clue about how their product is implemented, not just a drone reading from a prepared script.

[WS64]

I got an update from WD:

We would like to thank you for your reply.

According to the issue with samba cry we would like to inform you about the following:

WD takes the safe and secure use of our products seriously.

The reported issue is currently under the investigation by our vulnerability assessment teams.

Any and all product announcements regarding software, firmware updates and release notes will be posted to the WD Community Forum.

If you have any further questions, please reply to this email and we will be happy to assist you further.

Sincerely,
[Deleted]
Western Digital Service and Support
http://support.wdc.com

Btw, answered by the same person (at least the same first name) who answered me the first time…

[Ralphael]

uh huh… evaluating response… please note that this is all tongue and cheek… and not what really goes on behind the scenes… (it is much worse )

@WS64

We would like to thank you for your reply.

… we are replying to your reply that you reply to ours and did you thank you for our reply to yours? equal to salutations or just "hello from the other side… not really, more of a “yeah… mumble mumble…” (standard tech support reply from years of answering questions about the missing cup holder on new laptops).

@WS64

According to the issue with samba cry we would like to inform you about the following:
WD takes the safe and secure use of our products seriously.

no funny business here… we are serious… seriously, really. but we will evaluate how badly this might affect our product if the word ever gets out. So far so good… we don’t support linux meaning outside our own linux box

@WS64

The reported issue is currently under the investigation by our vulnerability assessment teams.

yeah, nothing to see here… Vulnerability support team of 1 who is on vacation at the moment. so far nobody has been affected… well maybe just that one or two or maybe a dozen, but we swapped them all out with another cloud and they are good now… nobody the wiser and nobody has really been affected… at least nothing provable. Really… seriously… really!!

@WS64

Any and all product announcements regarding software, firmware updates and release notes will be posted to the WD Community Forum.

If and only if management (Bob) approves. We won’t let you know unless we got a new update and only on the day… and if it is just before a weekend we will pull any updates, just in case of an influx of trouble users and we won’t tell you either on why we pulled the update. Of course we will tell our moderators first but unfortunately we don’t talk to them, so we won’t.

@WS64

If you have any further questions, please reply to this email and we will be happy to assist you further.

… cough Please don’t reply. it just goes to the spam folder…

Please quote me so this gets replicated before it gets deleted and removed in 24 hours.

[JAC70]

@JAC70

Thanks for the tip. The N300-series are actually more expensive than the WD Reds, and harder to find in Canada. I managed to find a 4TB on sale though, so I think I’ll be ordering it plus a DS116.

@nogood

I bought a DS116 and 4TB WD red last week. Price is nearly twice than My Cloud 4TB but performance is much better and I get security-updates just on time.

Setting up my DS116 right now, The NAS itself is amazing, but the Toshiba N300 is LOUD LOUD LOUD. I would not recommend this drive for use in the same room.

[nogood]

OT: Compared to WD red the N300 4TB has double power consumption, is 5-6dB(a) louder (factor 1.5!) and only 5 € cheaper (Germany).

[d_fens]

okay, where’s the Update for the MyClouds?! come on WD!

[nogood]

While there’s life, there’s hope…

[nogood]

WD strategy works well. Seems that nobody cares about this problem anymore…

Germanys famous computer magazine c’t writes these days (translation below):
“Sie [die Sicherheitslücke] ist nach Expertenmeinung relativ einfach für Angriffe ausnutzbar. Es ist zu vermuten, dass sie bereits im großen Stil für Angriffe missbraucht wird […]. Embedded-Systeme und NAS-Geräte, für die es keine Patches gibt, sollte man besser aus dem Netz entfernen.”

Google translation:
“The security gap is relatively easy to exploit for attacks. It is to be assumed that it is already abused in large scale for attacks […]. Embedded systems and NAS devices for which there are no patches should be better removed from the net.”

So far…

[d_fens]

SambaCry used in the wild: SambaCry is coming | Securelist

“…On May 30th our honeypots captured the first attack to make use of this particular vulnerability, but the payload in this exploit had nothing in common with the Trojan-Crypt that was EternalBlue and WannaCry. Surprisingly, it was a cryptocurrency mining utility!..”

[nogood]

5.500 USD? I should change to the dark side of the Force…

[d_fens]

where is an update?!

[cpt_paranoia]

Samba vulnerability discovered. Actually not WD's fault

Okay, this one isn’t WD’s fault. But let’s see how long it takes them to roll out the security patch…

[Myron]

Quite a long time by the sounds of it. I don’t really want to read negative here, really don’t, but I am quite perplexed why the delay.

[Myron]

Any updates on these issues?

[d_fens]

“we take the security of our customers data very bla bla bla…” still no update…

but a new my cloud device, my cloud home. WD releases more products than software updates

[cpt_paranoia]

@d_fens

but a new my cloud device, my cloud home

Looks like that’s compliant with WD’s ‘look and feel’. i.e. not working very well…

Mycloud serial number not recognized on support site

Just bought the updated Mycloud Home 2TB with the new look. Setup paper in book says to go to My Cloud Home, this redirects to the main website. I tried using /setup instead but it can’t find My Cloud. My Cloud is recognized by my router and gives an IP address but typing that address into a browser doesn’t connect me to the dashboard or anything. I tried to set up a call with support but the pre-form keeps kicking me out as it doesn’t recognize my serial number. Any ideas?

Also seems odd that they haven’t pushed out a new product notice on this forum. They have set up a forum for it, though. I wonder how different it is to our devices.

My Cloud Home - Personal Cloud Storage

You can get the quick start leaflet, but the user manual isn’t so successful…

4779-705163.pdf

ERROR
The request could not be satisfied.

Bad request.

Generated by cloudfront (CloudFront)
Request ID: [redacted]

[d_fens]

oh no! haven’t you learned anything?! get a refund and buy a synology!

[cpt_paranoia]

I haven’t bought one. I didn’t even know they existed…

[d_fens]

no update since April. That’s ridiculous for a linux server