An unpleasant surprise for My Book Live owners

Embedded devices need regular software updates in order to even be minimally safe on today's internet. Products that have reached their "end of life", thus are no longer being updated, are essentially ticking time bombs—it is only a matter of time before they are vulnerable to attack. That situation played out in June for owners of Western Digital (WD) My Book Live network-attached storage (NAS) devices; what was meant to be a disk for home users accessible via the internet turned into a black hole when a remote command-execution flaw was used to delete all of the data stored there. Or so it seemed at first.

Missing data

The first indication of the problem came in a June 23 post to the WD support forums by user "sunpeak" about a now-empty My Book Live device ("somehow all the data on it is gone today"), though the 2TB device had been nearly full before that. Sunpeak also reported that the administrative password had been changed so they could not log into the device. It was not long before others added their stories of woe to the thread. In the early going, there was concern that WD had released some kind of firmware update that caused this behavior, but it turns out that those devices have had no updates for quite some time at this point.

Various posters in the thread dug out the logs from their devices to see what they could determine. There were reports that some of the devices had been reset to the factory settings via the factoryRestore.sh script, for unknown reasons, but those reports also said that the default "admin" username (with the same password) did not work. Eventually, "t4thfavor" strongly suggested removing My Book Live devices from the internet by way of a firewall—or simply pulling the Ethernet cable entirely. That good advice was echoed by sunpeak and others in thread.

Not long after that, WD posted a security bulletin to the support forum with effectively the same advice. Both that post and the more formal WDC-21008 security bulletin were quick to point out that these devices were introduced in 2010 and stopped receiving updates in 2015. The WDC-21008 bulletin pointed to CVE-2018-18472, though no context was given. Looking at the CVE provides some missing context, though:

Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/language_configuration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the wild in June 2021 for factory reset commands,

Clearly the CVE description has been recently updated. But the 2018 date in the CVE number is telling; this flaw has been known for three years or so at this point. It was originally reported in a blog post at WizCase that offered much the same advice about removing the device from the internet. As shown by the proof of concept (PoC) in that post (and this report with a clearer PoC), simply tacking a command in backticks (e.g. `whoami`) to the data sent with an HTTP PUT command to the configuration URL will cause the command to be executed with root privileges. Backticks are used in various languages (e.g. Unix shells, PHP, Perl) to execute operating-system commands; the device's interface is written in PHP and shell scripts, so it seems clear that the input provided in the PUT is not being sanitized correctly.

But wait ...

On June 29, the picture got rather murkier. Ars Technica reported on some research it had done on the attacks in collaboration with Derek Abdine, CTO at security firm Censys. It turns out that there is a second, previously unknown flaw in the NAS devices: there is a way to do a factory reset through the configuration interface without providing a password. In fact, the relevant source code has the password checks commented out; anyone who knows how to format the XML-based request can wipe any My Book Live just by knowing its IP address.

It turns out that there is evidence that there are at least two attackers at work here—and they aren't working together. As Abdine described, it would seem that CVE-2018-18472 had been in use for some time, adding the devices to a botnet (possibly Linux.Ngioweb). The just-discovered factory-reset flaw (which does not yet have a CVE number) was only recently used, perhaps as a way to destroy or disrupt the botnet. Whatever the reason, though, exploiting that flaw and wiping the user data on the NAS is what brought the whole situation to light.

[Update: WD has put out more information about the factory-reset flaw, which it said is due to a botched refactoring effort. The bug has been assigned CVE-2021-35941. In addition, WD is offering data-recovery services for those who lost data.]

The configuration endpoint that was vulnerable to the original command-execution flaw (language_configuration.php) was being modified on devices that were being attacked that way. A password test was added so that only the original attacker could further exploit that particular flaw; a SHA-1 hash of the password is used in the modified version of language_configuration.php that has been recovered. As noted in both reports, though, the attacker apparently did not know that the parameters sent to the device's interface can be logged, so at least one of the "secret" passwords used by the attacker is now known. It was written, in plaintext, to a log on the device.

While "rival attackers" is only a theory, it makes sense that the botnet controller would have no need (or interest) in causing the factory reset. After all, they had full control of the system and could make it do whatever they wanted (including wiping the disks if that was somehow useful to them). All that the factory reset did was draw attention to the devices, leading to the exposure of the flaws and, thus, curtailing future My Book Live exploits.

Original response

At some point after the WizCase post in 2018, WD responded to it with much the same information as was in its recent responses. But in part of its response, which seems geared toward covering its ass more than anything else, it described the products in a way that may seriously irritate the owners of these NAS devices:

We encourage users who wish to continue operating these legacy products to configure their firewall to prevent remote access to these devices, and to take measures to ensure that only trusted devices on the local network have access to the device.

Calling these devices "legacy products" obviously reflects WD's level of interest in them, but it probably does not mirror the opinions of most folks who bought them. Turning off the security-update spigot around a year after the product was discontinued seems fairly short-sighted, especially for a system that was touted as one that can be connected to the internet in order to "securely access your media and files anywhere in the world". At some point, the company realized that those devices should not be connected to the internet, but did not make an update, nor, seemingly, raise the profile of this problem so that users could protect themselves.

While the product life cycle may be long finished from the perspective of WD, the devices are still available from outlets like Amazon. Anyone who buys one today might be forgiven for thinking it is still supported. A NAS device is not a cell phone or other consumer-electronics gizmo that might be shunted aside for the latest thing in relatively short order; one might well expect to set up a home NAS and have it running for years—or even a decade or more. One hopes that those who do set up such a device also have another backup strategy go with it, however.

It is, as a number of people have observed, fairly surprising that it took this long for the CVE-2018-18472 vulnerability to be exploited; maybe the recent updates have shown that it actually was used much earlier. The exploit is trivially easy to perform and it provides full access to what would seem to be fairly high-value data. These devices would make for prime ransomware targets, one would think, even if the most recent attackers were perhaps just digital vandals.

One way to route around device makers and their arbitrary life-cycle decisions would be to create and maintain an alternate firmware for the device. It is, after all, simply a Linux system under the covers. There is some information on the WD support site about how to build and install custom firmware, but there does not seem to be an active existing project for My Book Live. Firmware based on free software would at least be possible to fix, of course, even in the absence of a project keeping things up to date.

Device owners need to be extremely careful with the internet access they provide to the gadgets that they buy. That's easy to say, but can be hard (or impossible) to do in a world where everything from shoes to light bulbs come equipped with some kind of whiz-bang feature that requires internet access. Makers of devices that are attacked rarely suffer anything more than a bit of negative press—and that only briefly. Under those conditions, is it any real surprise that people can lose all of their important data, possibly via a vulnerability that has been public for years?