WD Sync Internet Non-Secure Transport

snakedoctorunit · January 22, 2016, 7:57pm

I noticed today at my work the transport was not secure (HTTP), but after enabling Fiddler2 it switched to secure (HTTPS). This concerns me as going over the internet my files are sent unencrypted back to my home. Has anyone else noticed this behavior. There is an option in the settings to go non-secure locally, but over a internet (WAN) connection all traffic be secure (HTTPS).

LAN
1/18/2016 10:59:38 PM Severity=INFORMATION Message=OnIsPending
1/18/2016 10:59:38 PM Severity=INFORMATION Message=OnUrlChanged - http://{lan_ip_address}/
1/18/2016 10:59:38 PM Severity=INFORMATION Message=Orion session created. MyCloud:{redacted} = http://{lan_ip_address}/ = {device_name}
1/18/2016 10:59:39 PM Severity=INFORMATION Message= Set up sync for {device_name}.

WAN Non-Secure
1/19/2016 10:02:50 AM Severity=INFORMATION Message=Sync thread terminated: {device_name}, {redacted} Location=CleanUpSync
1/19/2016 10:03:49 AM Severity=INFORMATION Message=Sync version: 1.1.5731.17046
1/19/2016 10:03:49 AM Severity=INFORMATION Message=OnIsPending
1/19/2016 10:03:50 AM Severity=INFORMATION Message=OnUrlChanged - http://device{redacted}.wd2go.com/
1/19/2016 10:03:50 AM Severity=INFORMATION Message=Orion session created. MyCloud:{redacted} = http://device{redacted}.wd2go.com/ = {device_name}
1/19/2016 10:03:52 AM Severity=INFORMATION Message= Set up sync for {device_name}.

WAN Secure
1/22/2016 10:14:07 AM Severity=INFORMATION Message=Sync thread terminated: {device_name}, {redacted} Location=CleanUpSync
1/22/2016 11:50:20 AM Severity=INFORMATION Message=Sync version: 1.1.5731.17046
1/22/2016 11:50:20 AM Severity=INFORMATION Message=OnIsPending
1/22/2016 11:50:40 AM Severity=ERROR Message=DeviceLogin WebException - The operation has timed out -
1/22/2016 11:50:40 AM Severity=ERROR Message=DeviceLogin WebException - The operation has timed out -
1/22/2016 11:50:40 AM Severity=ERROR Message=DeviceLogin Exception - The operation has timed out -
1/22/2016 11:50:40 AM Severity=ERROR Message=DeviceLogin Exception - The operation has timed out -
1/22/2016 11:50:41 AM Severity=INFORMATION Message=OnIsPending
1/22/2016 11:50:41 AM Severity=INFORMATION Message=OnUrlChanged - https://device{redacted}.wd2go.com/
1/22/2016 11:50:41 AM Severity=INFORMATION Message=Orion session created. MyCloud:{redacted} = https://device{redacted}.wd2go.com/ = {device_name}

ArMak · January 23, 2016, 7:07pm

Hello,

Before using the fiddler software the files were not being sent securely over the internet ? Does this happen when sending from your home to work as well ?

snakedoctorunit · January 23, 2016, 7:16pm

Yes, when looking back to 1/19/16 is when I noticed the HTTP connection from my work. The guest wifi uses the 10.x.x.x space then proxied to external IP addresses, but my home LAN uses 192.168.x.x space. SSL should be enabled whenever not on the home LAN. The WD My Cloud app uses SSL regardless when external. I turned on Fiddler on 1/22/16 to verify the session traffic. Confirmed.

I was able to replay a transaction from yesterday around 10AM last night at around 11PM using a GET request obtained from Fiddler session. I disabled Cloud Access afterwards, but re-enabled to test again this afternoon (1/23/16). The transaction returned results for which I promptly disabled Cloud Access again. Session timeouts need to be enabled to validate if the consumer is actually authorized to execute. I have seen where commands can be injected from a previous version, but would like to know if this has been addressed yet.