WD My Cloud NAS Devices Have Hard-Wired Backdoor
January 8th, 2018Via: Register:
If you have a Western Digital My Cloud network attached storage device, it’s time to learn how to update its OS because researcher James Bercegay has discovered a dozen models possess a hard-coded backdoor.
The backdoor, detailed here, lets anyone log in as user mydlinkBRionyg with the password abc12345cba.
WD mostly markets the My Cloud range as suited for file sharing and backup in domestic settings. But several of the models with the backdoor are four-disk machines suitable for use as shared storage in small business and also capable of being configured as iSCSI targets for use supporting virtual servers. Throw in the fact that some of the messed-up machines can reach 40TB capacity and there’s the very real prospect that sizeable databases are dangling online.
