T0@st
News Editor
- Joined
- Mar 7, 2023
- Messages
- 3,211 (3.98/day)
- Location
- South East, UK
| System Name | The TPU Typewriter |
|---|---|
| Processor | AMD Ryzen 5 5600 (non-X) |
| Motherboard | GIGABYTE B550M DS3H Micro ATX |
| Cooling | DeepCool AS500 |
| Memory | Kingston Fury Renegade RGB 32 GB (2 x 16 GB) DDR4-3600 CL16 |
| Video Card(s) | PowerColor Radeon RX 7800 XT 16 GB Hellhound OC |
| Storage | Samsung 980 Pro 1 TB M.2-2280 PCIe 4.0 X4 NVME SSD |
| Display(s) | Lenovo Legion Y27q-20 27" QHD IPS monitor |
| Case | GameMax Spark M-ATX (re-badged Jonsbo D30) |
| Audio Device(s) | FiiO K7 Desktop DAC/Amp + Philips Fidelio X3 headphones, or ARTTI T10 Planar IEMs |
| Power Supply | ADATA XPG CORE Reactor 650 W 80+ Gold ATX |
| Mouse | Roccat Kone Pro Air |
| Keyboard | Cooler Master MasterKeys Pro L |
| Software | Windows 10 64-bit Home Edition |
News reports about Western Digital's implementation of new security measures started appearing online last week—My Cloud product owners were puzzled upon discovering that their access to cloud services had been blocked. Devices not updated with the latest firmware - version 5.26.202 (My Cloud) and 9.4.1-101 (My Cloud Home, SanDisk ibi) - were and continue to be barred from the start date effective June 15. This relatively new measure has been implemented in order to prevent further exploits of security vulnerabilities. WD is likely shoring up its online defenses following a major cyber attack on its My Cloud back in March, a hacker group demanded a hefty ransom fee for the return of private customer data. WD restored My Cloud services by mid-May, and released several software updates and security fixes.
According to a company security bulletin (issued last week): "Devices on firmware below 5.26.202 will not be able to connect to Western Digital cloud services starting June 15, 2023, and users will not be able to access data on their device through mycloud.com and the My Cloud OS 5 mobile app until they update the device to the latest firmware...Users can continue to access their data via Local Access." The latest fixes should protect customers from unauthorized access and ransomware attacks, but WD has not provided any further news about any ongoing negotiations with the hacker group behind the Spring data breach.
WD's bulletin states: "We periodically release firmware updates to the My Cloud, My Cloud Home and SanDisk ibi devices to improve device security and reliability."
Their list includes the following products:
Bleeding Computer's report included this information: "The above firmware versions were released on May 15, 2023, fixing the following four vulnerabilities:"
View at TechPowerUp Main Site | Source
According to a company security bulletin (issued last week): "Devices on firmware below 5.26.202 will not be able to connect to Western Digital cloud services starting June 15, 2023, and users will not be able to access data on their device through mycloud.com and the My Cloud OS 5 mobile app until they update the device to the latest firmware...Users can continue to access their data via Local Access." The latest fixes should protect customers from unauthorized access and ransomware attacks, but WD has not provided any further news about any ongoing negotiations with the hacker group behind the Spring data breach.
WD's bulletin states: "We periodically release firmware updates to the My Cloud, My Cloud Home and SanDisk ibi devices to improve device security and reliability."
Their list includes the following products:
- My Cloud PR2100 - 5.26.202 or later
- My Cloud PR4100 - 5.26.202 or later
- My Cloud EX4100 - 5.26.202 or later
- My Cloud EX2 Ultra - 5.26.202 or later
- My Cloud Mirror G2 - 5.26.202 or later
- My Cloud DL2100 - 5.26.202 or later
- My Cloud DL4100 - 5.26.202 or later
- My Cloud EX2100 - 5.26.202 or later
- My Cloud - 5.26.202 or later
- WD Cloud - 5.26.202 or later
- My Cloud Home - 9.4.1-101 or later
- My Cloud Home Duo - 9.4.1-101 or later
- SanDisk ibi - 9.4.1-101 or later
Bleeding Computer's report included this information: "The above firmware versions were released on May 15, 2023, fixing the following four vulnerabilities:"
- CVE-2022-36327: Critical severity (CVSS v3.1: 9.8) path traversal flaw allowing an attacker to write files to arbitrary filesystem locations, leading to unauthenticated (authentication bypass) remote code execution on My Cloud devices.
- CVE-2022-36326: Uncontrolled resource consumption issue triggered by specially crafted requests sent to vulnerable devices, causing DoS. (medium severity)
- CVE-2022-36328: Path traversal flaw allowing an authenticated attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users, and device configurations. (medium severity)
- CVE-2022-29840: Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback. (medium severity)
View at TechPowerUp Main Site | Source
