WD My Cloud

2023

Discovery of a vulnerability in the firmware of network storage

The company Western Digital thanked expert Positive Technologies Nikita Abramov for discovering vulnerabilities Western Digital network storage in the firmware. The vulnerability could lead to remote execution of arbitrary code in repositories, loss data and violation of privacy. information Vendor was notified of the threat as part of the responsible disclosure policy and issued an update to address the deficiencies. Positive Technologies announced this on August 24, 2023.

The CVE-2023-22815 vulnerability, rated 8.8 on the CVSS 3.0 scale, was identified in the My Cloud OS 5 v5.23.114 firmware. This internal software is used in several lines of Western Digital network devices: My Cloud PR2100, My Cloud PR4100, My Cloud EX4100, My Cloud EX2 Ultra, My Cloud Mirror G2 and others.

The most dangerous scenario is the complete seizure of NAS management - network attached storage, a server for storing files. It is also called network or file storage, "said Nikita Abramov, a specialist at the PT security analysis research center SWARM. - All further steps depend on the attacker's tasks: data theft, modification, complete removal or deployment of any attacker's software based on NAS. The cause of the vulnerability may be due to the addition of new functionality to the NAS and the lack of security checks. In other similar places of the web interface that could be used to implement commands, the received data was filtered and checked for correctness, which would not allow such an attack.

At the time of writing, the IP addresses of more than 2,400 Western Digital network stores remained available on the global network. Their largest number is in Germany (460), the USA (310), Italy (257), Great Britain (131) and South Korea (125).

Western Digital recommends installing an updated version of My Cloud OS 5 v5.26.300 firmware on all devices affected by this vulnerability.

Malfunction within a week

On April 7, 2023, Western Digital offered customers a workaround to access their files stored on the My Cloud cloud service. Serious problems in the operation of this platform arose after a cyber attack, the consequences of which the company could not eliminate even after a week.

As a result of the cyber incident, Western Digital products such as My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS 5, SanDisk ibi and others suffered. In addition, related applications for mobile devices and personal computers were affected. The company had to shut down a number of services to ensure security and "protect business operations." Western Digital says that experts are working to "restore the affected infrastructure and services," but it is not possible to quickly solve the problems that have arisen.

Western Digital has offered customers a workaround to access their files stored on the My Cloud cloud service

The company's alternative method of accessing files is suitable for My Cloud Home, My Cloud Home Duo SanDisk and ibi. This requires a computer running Windows or macOS that is connected to the same network as the Western Digital device. With Local Access, users can open their files. It is noted that for My Cloud OS 5 products (My Cloud PR and EX series), local access is enabled by default.

To activate local access, use your browser and connect to the control panel of your device. Then enable Local Access and create a new account. We continue to make every effort to restore all services as quickly as possible and will provide updates as they become available. We apologize for any inconvenience and thank our community of users for their patience, Western Digital said in an official statement.[1]

2017: Popular WD MyCloud hard drives have been vulnerable since 2014

A number of different problems were found in personal NAS devices (external hard drives) Western Digital MyCloud^[2].

The first, most easily exploited vulnerability is the backdoor encoded in the system. Using a combination of mydlinkBRionyg:abc12345cba characters, everyone can access the device's memory. An account with this login and password does not have administrative authority, but privileges can be increased using other vulnerabilities.

An attacker can act not only through the Internet, but also through a local network (that is, already behind the firewall).

Exploitation is extremely simple: it is enough to inject a malicious iframe or one-pixel image into the code of any site, which, unnoticed by the user, will send a request to the vulnerable device using any of the names of the WD MyCloud host - they are usually predictable and, as a rule, look like wdmycloud, wdmycloudmirror and so on.

The report by Gulftech, whose experts discovered the vulnerability, provides several examples of malicious code that allow you to seize control of a device or format it without the need for any authorization.

Issues affect MyCloud, MyCloud Mirror, My Cloud Gen 2, My Cloud PR2100, My Cloud PR4100, My Cloud EX2 Ultra, My Cloud EX2, My Cloud EX4, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, and My Cloud DL4100.

Problem: Downloading Arbitrary Files

The bug is associated with the multi_uploadify.php file and the incorrect implementation of the gethostbyaddr () function. They allow an attacker to download any files to the device without restrictions with the prospect of taking control of it. The corresponding module, by the way, has already been added to the Metasploit set.

Experts also call the exploitation of this vulnerability "trivial."

Issue: Vulnerability to CSRF attacks and command injections

MyCloud NAS devices were extremely vulnerable to popular types of cyber attacks - ranging from CSRF to DoS. Also, a simple GET/api/2.1/rest/users? HTTP/1.1 allowed you to get a list of users and detailed data about each of them.

Late fixes

Western Digital has already announced in its blog that the new firmware version 2.30.172 fixes all these vulnerabilities.

2016

My Cloud EX2 Ultra

February 17, 2016 the corporation Western Digital introduced the professional solution WD My Cloud EX2 Ultra - a high-performance NAS () NAS with two hard drives.

The device is designed for use in creative professions, where automatic data synchronization between computers, file sharing, and many backup options are required. This will allow specialists and representatives of creative professions to manage a personal digital library.

My Cloud EX2 Ultra (2016)

We know that My Cloud storage owners, especially creative professionals, need end-to-end storage and sharing solutions as the need to preserve digital information continues to grow and the ability to stream data is required. My Cloud EX2 Ultra is optimized for multitasking. It combines high performance and data protection tools to help professionals and advanced users simplify their workflow and perform routine tasks with great comfort. Jim Welsh, Executive Vice President and Head of WD Branded Products

My Cloud EX2 Ultra (2016)

The My Cloud EX2 Ultra system is equipped with a 1.3 GHz dual-core processor that transmits data for smooth video streaming. The drive is equipped with 1 GB of DDR3 RAM.

Features of management and security settings allow users to independently choose the method of storing and protecting data - movies, music, photos, etc. Drives support operation in RAID 0, RAID 1 JBOD and spanning modes, backups can be made in several ways: to another NAS, to external storage via USB port, to the "cloud" or over a LAN/WAN network. For greater reliability, My Cloud EX2 Ultra comes with drives in a RAID 1 configuration (it can be changed at any time).

The total storage capacity is up to 12 TB. External storage can be connected to the device via USB 3.0 port. Versions with pre-installed hard drives use WD Red drives..

The product includes software for creating user accounts, changing settings and monitoring the status of drives. Provides access to files and configuration of the drive through the MyCloud.com site or the My Cloud mobile application. The WD Sync feature helps sync selected files on all My Cloud computers and cloud drives.

My Cloud EX2 Ultra uses advanced protocols to work with data, including a built-in FTP and WebDAV server, a server for working with backups, a server for P2P loading and support for Microsoft Active Directory technology. Users can download and use third-party apps like Plex, aMule, Icecast, Joomla!, Anti-Virus Essentials, WordPress, SqueezeCenter, Milestone Arcus video surveillance systems and others. It is possible to broadcast videos and photos from the drive to connected TVs, media players, game consoles and other DLNA/UPnP devices through the Twonky 7.2 media server and built-in iTunes support.

The complex is compatible with, Windows 10,, Windows 8,, Windows Vista OS X El Capitan Yosemite Mavericks, Mountain Lion and devices that support DLNA and UPnP protocols.

The start of sales in Russia is scheduled for March 2016.

WD My Cloud EX4

My Cloud EX4 is a high-performance device with four storage bays. Big Brother, with all the benefits described above, takes the capabilities of the home cloud to the next level: disks can be included in RAID 0, 1, 5 or 10, as well as combined or used separately (JBOD). My Cloud EX4 is equipped with well-known WD Red series hard drives specifically designed for use in networked storage designed for home and small office applications. NASware 2.0 technology significantly improves the stability of these drives and protects user data in the event of a sudden power outage. In addition, WD Red hard drives use modern 3D Active Balance Plus balancing technology, which significantly improves their overall performance and reliability.

My Cloud EX4 comes in several variants: 8, 12 and 16 TB. You can purchase a system without drives, then the only concern of the user will be the choice of hard drives for your requests. Easy-Slide-Drive technology allows you to replace and mount drives in seconds, without a screwdriver or other tools or appliances. In addition, at any time, users will be able to increase the capacity of the system by connecting a disk with interface USB 3.0 to it.

My Cloud EX4 is a home digital entertainment hub with a maximum capacity of 16 TB. This personal cloud is capable of not only storing movies and music, but also allows you to stream to any DLNA/UPnP certified multimedia device. The device is ideal for workers in creative professions and the most demanding users.

2015: WD My Cloud OS 3

On September 1, 2015, WD announced the release of My Cloud OS 3 and the Software Development Kit (SDK), which provides advanced application integration.

The My Cloud OS 3 operating system has an intuitive interface and capabilities for sharing, backing up and synchronizing data.

The OS provides the ability to configure automatic photo backups from smartphones and tablets, easily and quickly moving files to My Cloud drives. The platform supports Chromebooks and Chromecasts.

On October 22, 2015, WD introduced in Russia an operating system for drives of the My Cloud family - My Cloud OS 3. The upgraded platform expands the functionality of personal cloud NAS,

My Cloud OS 3 Presentation (2015)

In this version, the developers have added a MyCloud.com service that provides users with global access to their drive through an intuitive web interface, helps to share files, view photos and videos.

The functionality of My Cloud OS 3 - WD Sync, synchronizes data on several PCs and laptops, ensuring that important files are updated and available to users from any device.

My Cloud OS 3 Presentation (2015)

The platform offers a convenient tool for configuring automatic data backup. The user can set a backup schedule, and data from selected devices (PCs, smartphones, tablets, etc.) will be duplicated to the cloud drive.

In addition to My Cloud OS 3, the company released the My Cloud Device SDK on Docker open platform technology and the My Cloud API. With their help, you can create new extensions, add functions within the My Cloud personal cloud ecosystem.

"We are glad to acquaint Russian journalists with the capabilities of our new software product," said Andrey Tishchenko, head of the Russian representative office of WD. - Working on the creation of My Cloud OS 3, we took into account the interests of both users and our partners - software developers. The result is a functional system with a user-friendly interface and many capabilities for storing, synchronizing and accessing data. But most importantly, the My Cloud ecosystem continues to evolve, and we will continue to work to ensure that our devices meet the latest market requirements. "

The operating system for devices of the My Cloud family, My Cloud OS 3 is available for free update on existing personal cloud drives My Cloud. OS 3 supports devices: My Cloud, My Cloud Mirror, My Cloud Expert Series EX2/EX4, My Cloud Expert Series EX2100/EX4100 and My Cloud Business Series DL2100/DL4100.

2014

WD, a division of Western Digital, announced in October 2014 that the WD My Cloud mobile application for remote connection to the drive of the same name had been downloaded more than 4 million times. In this regard, and in order to make access to the personal "cloud" from mobile devices even easier, the company is updating the WD My Cloud OS software to version 1.5, including firmware and a mobile application. The free update is available for all My Cloud devices, including My Cloud Mirror, My Cloud EX 2 and My Cloud EX 4.

The My Cloud family of cloud drives gives users access to their own digital content from portable devices based on iOS or. In Android WD My Cloud OS 1.5, the mobile application will have a new Media View feature, which provides a fundamentally new approach to viewing and searching for photos, music and videos. Also, users will be able to manage all their "cloud" storage using a single application with a user-friendly interface: WD My Cloud provides access to content stored on popular public "cloud" services - Dropbox, OneDrive Google and Drive.

2013

WD, a division of Western Digital, a provider of drives and digital lifestyle solutions, introduced the My Cloud generation of personal cloud storage solutions in fall 2013. WD My Cloud provides users with secure, centralized networked storage for all digital content that can be accessed from any computer and mobile device from anywhere in the world. By connecting to this service, they get at their disposal a free personal cloud drive and retain full control over their personal data.

According to the firm's Gartner research, the average household will own approximately 2.2 TB of digital information by 2016. In parallel with the increase in data volumes, the number of devices connected To the Internet to the devices is growing rapidly, which, according to analysts at NPD Group, currently account for 5.7 per household. Taken together, these two trends require the development of a new digital content storage paradigm that would allow consumers to take full control of their data. Personal cloud storage is a new standard for this kind of system, preserving the ability to store media files and documents on a local home drive, but at the same time providing access to them via the Internet from any computer such as a PC or Mac, as well as tablets and. smartphones With My Cloud, users can share their files, stream, and securely work with their data stored on the local home drive from anywhere in the world, without any subscription fees.

Easy to install and back up

It takes minutes to install and configure a WD personal cloud solution using the built-in universal web interface. The WD software is able to automatically recognize the connected drive, which makes working with the system even easier. Once the installation is complete, the user can simply connect all their computers and mobile devices to My Cloud using free utilities. With Gigabit Ethernet and a dual-core processor, file transfers are extremely fast, allowing you to dynamically update and keep up-to-date centralized storage of all their digital content. With direct download of files from mobile devices, all important files and videos can be safely moved to My Cloud, freeing up additional memory on your tablets and smartphones.

In addition, cloud storage can be used for backup. PC users can use WD SmartWare Pro for this purpose. And owners of computers like Macs will be able to use all the functions of the Apple Time Machine program.

Under full control

My Cloud users can store their family photos, videos, music, and important documents in a single secure vault connected to their home network. The new software one for PCs allows you to intuitively manage and use these files from anywhere in the world. My Cloud comes with 2, 3 and 4 TB capacity, providing users with a cloud service service data storage without any subscription fee. You can increase the capacity of a system by connecting any compatible hard drive 3.0 interface to it USB.

In addition, My Cloud will serve as the central home hub for storing terabytes of videos and music. The system also supports the function of streaming multimedia content to any DLNA™-certified device, for example, to a WD TV Live media player, smart TV or game console.

Access to personal cloud storage

WD My Cloud mobile apps for iOS and Android devices allow you to view photos, stream videos and work with documents using smartphones and tablets. Mobile applications also make file sharing a simple and secure process, helping their owners to easily email files, provide a link to their documents, print and open files using a variety of applications.

In addition, the My Cloud mobile app provides access to all major public cloud services, so users can move files between different systems such as Dropbox, SkyDrive and Google Drive.

Notes