Searched the forum and didn’t see anything similar so I’m starting a new post.
Brand new WD MY Cloud 4tb. Updated to the lastest firmware (v04.00.00-607).
Any PC on the network that goes to the IP Address of the My Cloud Dashboard gets a sign on screen with the “Admin” username already cached. Seems to me this is a major security No - No. Half the battle for a hacker is already done by having a valid username already in place.
Anyone else notice this behaviour? Is there a workaround or fix for this?
I have tried PC’s with IE9, 10 and 11 as well as Chrome browsers. Every PC that I went too already had the “Admin” name cached on the sign on screen. Even PC’s that have never went to that IP address. Therefore, I know it’s not cached in the browser on the PC. The WD My Cloud is offering it up at the sign on screen.
I have not seen this, I normally use Firefox. I also changed the admin name during initial setup, not sure if it matters
However unless you are going to setup tunnels in your router or plase this outside your router I am not sure it really matters as it is only accessable on your LAN, not the Internet. Unless you don’t trust the people in your house:smiley:
Where is your network setup? Mine is in my home and only my daughter and I can get on it. I do have several devices on it but they are used by us.
My home network is a secure network meaning anyone trying to use it has to have the user name and password. They would have to get through that to be able to get to my My Cloud.
This particular My Cloud is setup in a small office.
Yes, I trust the people on the LAN. However, this is still a potential security flaw that should not be ignored. In the IT and Network field, having a device readily give you a valid username already filled in is cause for concern.
Have you read the _ Help _ provided in the dashboard? The following is copied from there.
Role of Users in Your Personal Cloud
Everyone who accesses your personal cloud must have a user account for the WD My Cloud drive. As the WD My Cloud owner, you have a special user account (admin) that gives you administrator privileges. With these privileges, you can set up and configure the drive to your specific needs, as well as add other people to your personal cloud. You have the power to determine exactly what other users can access on the drive.
As a default, the admin user name does not have a password. You can add one anytime.
Important: When initially setting up your drive, you have the opportunity to change the administrator name and set an optional password while running the WD My Cloud setup software or completing the Getting Started screens. Make sure you keep track of the name and password. You won’t be able to display the WD My Cloud web interface without those credentials.
When I setup the My Cloud initially, I did give it a username (not the name Admin) and I did assign it a password. When any PC on the lan goes to the dashboard IP address using a web browser, the name I setup as the “Admin” account is already filled in the username box. This should not happen. The dashboard should come up and the username and password fields should be empty.
