Western Digital NAS device suffers from a potential Privacy issue
In this article (5)
The default configuration of Western Digital My Cloud EX2 network drives allows any unauthorised user on the local network to extract files by sending HTTP requests, according to security researchers. Western Digital’s My Cloud devices are storage/backup device that lets users backup and store important documents, photos and media files.
In a security advisory, researchers at Trustwave said that when the device is switched on, the UPnP-media server automatically starts, which by default allows any user who can send HTTP requests to the device to extract any files. Thus, it is possible to bypass any permissions or restrictions set by the owner or administrator of the device.
“It is possible to access files on the storage even when Public shares are disabled. Specifically, anyone can issue HTTP requests to TMSContentDirectory/Control
on port 9000 passing various actions. The Browse action returns XML with URLs to individual files on the device,” said researchers.
Researchers said that they had informed Western Digital about the problem in January of this year, but the manufacturer said that it will not release a patch. As a measure to prevent exploitation of the vulnerability, users are advised to disable DLNA if important data is stored on the device. Western Digital recommended that users follow this knowledge base article to turn off DLNA “if they do not wish to use the product feature.”
Jason Garbis, vice president at Cyxtera, told that like all network-attached devices, organisations need to engage with their information security teams prior to deploying this drive onto their network.
“Organisations of all sizes need to take a more proactive approach to network security and apply a zero-trust philosophy to their network. Once again, this vulnerability demonstrates that network access to a system – even without login credentials – is a privilege that must be managed. Today’s networks are far too open, which is a root cause of the many successful attacks and breaches affecting the IT industry,” he said.
“With proper configuration, this device can be safely used. It should have the DLNA (UPnP) feature disabled, and ideally should have network access restricted to only authorised users. Deployed in its default configuration, this device exposes businesses to unnecessary risk of data breach, either to malicious insiders or external attackers.”
Earlier this year, another security researcher found a plethora of vulnerabilities, such as pre auth remote root code execution, as well as a hardcoded backdoor admin account which cannot be changed. The backdoor also allows for pre auth remote root code execution on the affected device. The backdoor allowed anyone log in as user mydlinkBRionyg with the password abc12345cba. Western Digital has since issued a fix for this problem. It can be found here.
Questions & Answers
Q.Which specific Western Digital devices are affected by this potential privacy issue?
Which specific Western Digital devices are affected by this potential privacy issue?
A.
The potential privacy issue affects Western Digital My Cloud EX2 network drives. These are storage/backup devices that allow users to store documents, photos and media files.
Q.What is Western Digital's recommended solution for users to prevent exploitation of this vulnerability?
What is Western Digital's recommended solution for users to prevent exploitation of this vulnerability?
A.
Western Digital recommends that users disable the DLNA feature if important data is stored on the device and they do not wish to use that product feature. They have provided a knowledge base article for this.
Q.What is the difference between this vulnerability and the one found earlier this year?
What is the difference between this vulnerability and the one found earlier this year?
A.
This current issue involves the UPnP-media server allowing file extraction via HTTP requests. Earlier this year, a different researcher found vulnerabilities including a hardcoded backdoor admin account, which Western Digital has since issued a fix for.
Reader pulse
What is Western Digital's biggest failure?
23,526 votes so far