Shortly after hackers remotely wiped internet-connected My Book Live devices, researchers shared a new zero-day vulnerability affecting Western Digital products running MyCloud OS 3.
KrebsOnSecurity reported that the researchers discovered this vulnerability in 2020 and planned to present it at the Pwn2Own hacking competition last November. Western Digital addressed the vulnerability with the release of MyCloud OS 5, however, so the research wasn’t presented.
That doesn’t mean the vulnerability is irrelevant. MyCloud OS 5 isn’t available for all Western Digital products, and some customers have reportedly held off on updating because it lacks features available in MyCloud OS 3. Unfortunately that also leaves these devices open to attack.
Western Digital has also said it won’t provide additional updates for MyCloud OS 3, so devices running the operating system will continue to be affected by this vulnerability. That revelation is made all the more troubling by the fact that the researchers demonstrated an exploit for the security flaw in February after Western Digital seemingly ignored their warnings about the issue.
Western Digital told KrebsOnSecurity that “the communication that came our way confirmed the research team involved planned to release details of the vulnerability and asked us to contact them with any questions.” It didn’t have any questions, though, so it didn’t reply to the message.
The company said it has updated its process to “respond to every report in order to avoid any miscommunication like this again” and that it takes “reports from the security research community very seriously and conduct investigations as soon as we receive them.”
People affected by this flaw have a few ways to defend themselves from attack: Upgrade to MyCloud OS 5, purchase a device capable of running MyCloud OS 5, install custom firmware that has to be re-enabled when the device is powered on, or disable remote access entirely.
