Alert for Western Digital 'My Cloud' Storage Device users.

[LSW]

Critical Unpatched Flaws Disclosed In Western Digital 'My Cloud' Storage Devices

https://thehackernews.com/2018/01/western-digital-mycloud.html

Quote

Western Digital's My Cloud (WDMyCloud) is one of the most popular network-attached storage devices which is being used by individuals and businesses to host their files, and automatically backup and sync them with various cloud and web-based services.

The device lets users not only share files in a home network, but the private cloud feature also allows them to access their data from anywhere at any time.

Since these devices have been designed to be connected over the Internet, the hardcoded backdoor would leave user data open to hackers.

Researchers also found the existence of a "classic backdoor"—with admin username "mydlinkBRionyg" and password "abc12345cba," which is hardcoded into the binary and cannot be changed.

So, anyone can just log into WD My Cloud devices with these credentials.

 

Besides these two above-mentioned critical vulnerabilities, researchers also reported some other important flaws.