Nazar78 wrote:
Possibilities that you got hacked. The RSA print generated from /etc/ssh/ssh_host_rsa_key.pub, should not change unless there were changes to the system i.e. factory reset. Weird is that why some hacker would raise an alarm by making obvious changes to the system?
Are you on dynamic or static? If dynamic, my wildest thoughts are your IP changed and your domain still points to your previous IP ( btw you exposed your domain and the IP is pingable, pls edit your post ) and someone else got issued with your previous IP and coincidentally that someone is having a wdmycloud device with port 22 opened or dmzed to public and root is at default password. I may sound dumb, but do you recognise anything from your data mount? Cos you didn’t mention if the data are intact i.e. users account still valid.
Back to reality, this is a serious issue but the cloud by default had the ssh off and neither using upnp to expose port 22, so called their no ssh support. Take a look at the sshd logs, for sure there’s force attempts every hour once port 22 is open to the net. I have mine exposed to the net but I also took extra precautions such as to disable root password logins, created a separate sudo access, wrote a perl script to black list IPs doing ssh port scans and multiple login failures.
And if this was not caused by unauthorised logins, something did triggered the factory reset. May be WD can answer this…
Thank you for the excellent info. I needed a reaffirmation of what possibly may go wrong; of course with WD this isn’t too hard.
Pretty sure I wasn’t hacked as all the data was intact, but a factory reset is confirmed which is probably the answer to why the RSA Key changed.
The WD is behind a NAT with no port 22 exposed to the net, although the MyCloud App and access through the MyCloud server plus port is wide open and the fact that a factory reset did occur sometime after I access the device through the MyCloud app service indicates that I must have finger mashed an option to do a factory reset from the iPad Cloud app of which I also saw today that you can update your WD firmware from the cloud app;
re: updating firmware from ipad app - is the most stupidest thing I ever saw since when would I do this over a Cloud App?
I just started up the app again and there are no options to do a factory reset, however it has been many months since I had last used the app and it may be a new version of the app that issues a factory reset command to my WD… again this is idiotic!!
WD called yesterday after I had posted up this post and I did not answer them.
Although I appreciate their attempts at customer service, I don’t enjoy being a beta tester for their devices as my last phone call from them had me doing gymnastics with my devices until I said “thats enough”, reseting and updating the firmware with my USB WD drive has nothing to do with the thrashing that occurs when booting up the cloud device with the USB drive attached. The answer from tech is always do a full factory reset.
For the last four years since I had the WD Live, followed by the Cloud and My Book, we never really receive answers to all the problems that we post up here. I would like answers.
Now I do know that this mess started with a Cloud access to my wd drive through the iPad app.
A factory reset command was issued to my WD drive.
I know that my drives had been factory reset by the fact that all my normal scripts that I had in the local bin directory were gone and the log show a factory reset.
Thus I know that we can update the firmware through the iPad app (and it prompts me everytime I start up the iPad app). Seriously, this is not the place for a firmware update to be issued. What if my son or daughter is using the app and though ok, great idea lets update?
Now since your cloud server needs access to my WD device, is it also issuing a device reset when it is out of date? If I was not at home that day when this factory reset occured, I would have been very upset by the fact that I couldn’t access the device afterward until I did a power reset…
Seriously WD, although I have been a firm supporter in your devices I am begining to tire
-
that you haven’t made any great changes in the software since the begining of the year except for the few minor fixes,
-
you have done nothing to fix the scanning of media
-
you have done nothing to fix the sleep mode of which my device still wakes up almost hourly despite almost every service has been deactivated.
-
and now the ability to do a firmware update via an iPad app?
-
are you also issuing a factory reset from the iPad app too?
-
tech support that seems like great customer service is nothing more then having the customer following a step by step procedure without understanding the cause of the software bug and I have already listed the bugs and fixes almost a year ago.
Last words…
-
If your ipad app does issue a factory reset for any reason… “DON’T” and if you do, prompt the user and allow the user to cancel.
-
remove the ability to update the firmware from the iPad app. This is not the place to do it. The only place to update the firmware is within the UI panel. addendum to this, if you don’t want to remove this, then don’t keep popping up every time I start the app, this is annoying.
