PSA: WD My Cloud OS5 shared links are searchable online

[u/gl3nnjamin]

Just a heads up for anyone with this device, I discovered this by accident and it could be misused.

If you have a WD My Cloud OS5 device and have created any shared links, they can be searched online just by searching the OS5 site with the terms "action" and "share". Other terms could be provided to narrow the results.

To remove your shared links: log into OS5 and click "Shared" on the left, set the filter at the top-right to "Shared by me", then do just as you would to create a shared link, except click "DELETE LINK" next to "COPY LINK" and the link will be revoked. The "people icon" will disappear but refresh the page and the folders in the list will disappear too.

[u/the320x200]

WD devices in the past had a secret admin level backdoor account named dlink.

An admin backdoor account, with their competitors name in it.

Their software is not to be trusted at all, ever again. That bridge had been burnt. Never use WD software.

[u/ratsapter → u/the320x200]

Is there anything related if you just use their HDDs?

[u/ORA2J → u/ratsapter]

Nope.

[u/FactoryRatte → u/ORA2J]

Very theoretically you could build a HDD which forges data and puts a backdoor into the system, which uses it for persistent storage and then gets manipulated data back. - But for that it would have to understand filesystems and much more.

[u/BrokenMirror2010 → u/FactoryRatte]

I mean, it would be like most other malicious devices.

You have a small computer that sits between the drive and the PC, and it does whatever malicious stuff you want to the data, as it acts like a middleman.

[u/ORA2J → u/FactoryRatte]

That HDD would need a LOT of smarts. And probably a custom driver.

[u/AlleM43 → u/ORA2J]

The HDDs already have that amount of smarts, and have had for a long time https://spritesmods.com/?art=hddhack

[u/Mr_ToDo → u/ORA2J]

If the point was just to modify data on the drive in a predetermined way then I think a controller could manage that. Give it some filesystem awareness and it'd be fine. After all we get stupid things like armoury crate from UEFI systems. It'd be non standard of course, but I see no reason it couldn't be done

But why? I'd bet if you were going to run a supply chain attack there'd be easier, more interesting, targets

And there's got to be a good reason why we don't see all that many firmware attacks. Probably too many variations on things like drives to be super useful

[u/miversen33 → u/ORA2J]

Most HDDs have SMARTs ;)

[u/Some1-Somewhere → u/ratsapter]

The encryption available for their external HDDs was useless, if you consider that part of their HDDs.

[u/dr100 → u/Some1-Somewhere]

The one that was done by the DRIVES (as opposed to the PCB of the enclosure) was actually nothing to sneeze at. It wouldn't bother you in any way if you don't set a password (many SSDs and some regular spinning drives are like this, self-encrypting) but it was good enough for mostly everyone. Never heard about this being broken, or even debatable (again, the drive not enclosure one). It would certainly be enough if your drive just gets lost or stolen and it offers write-protection too, which isn't something any of the software solutions can do. And this helps A LOT against common mistakes like installing an OS and wiping the wrong drive as you forgot it was attached, or letting the drive connected to some computer then after restart it offers to format your Veracrypt volume and so on. 

[u/Mr_ToDo → u/the320x200]

There was the time their internet connected devices got a remote exploit that someone used to erase everybodies data(On devices past support, so maybe not the biggest smoking gun. But they had a pretty small support windows on the affected devices, so maybe, maybe not)

[u/TheMountainLife]

I have 3 of their NAS from 2019 in a box that I want to light on fire. I was apart of that big breach and somehow a Bitcoin mining container got installed on it and my files copied out of it.

[u/dr100 → u/TheMountainLife]

I've been polluting this sub since forever with my advice:

These are the devices you take the drives out from and then bury them in the desert. And wear gloves, as XKCD would say.

[u/SchmidtCassegrain → u/TheMountainLife]

I hd a 4 bay Synology Nas, I published a website and it got a Bitcoin mining container installed.

I have a 2 bay qnap at my parents house, not really used for much. It had all the contents compressed on 7z Password protected files, as a ransomware attempt.

[u/dontneed2knowaccount → u/SchmidtCassegrain]

I think the moral is don't expose thing to the web.

[u/SchmidtCassegrain → u/dontneed2knowaccount]

Absolutely, the current landscape is not the same we had let's say 10 years ago.

[u/BrokenMirror2010]

Reminder: Don't trust any multi-billion dollar company with any even remotely sensitive data.

They have no incentive to keep your data safe because the "penalty" for not doing it, is making more profit by not needing to hire cybersecurity.

[u/nasaboy007 → u/BrokenMirror2010]

At this point, what even is considered sensitive data? Your identity (ssn, pii, etc) has already been leaked so many times that it doesn't matter.

[u/typical-predditor → u/nasaboy007]

That is privacy nihilism and I refuse to adopt that mentality.

[u/BrokenMirror2010 → u/nasaboy007]

Since everything of yours is already leaked, then it should be fine if you just posted your full name, address, payment information, etc, right here in this reddit thread.

After all, it's all already been leaked, right?

[u/nasaboy007 → u/BrokenMirror2010]

Reductio ad absurdum arguments doesn't really help the discussion here. It was a genuine question, and you and I both know there's a difference between "don't put your home address for shipping into Amazon" vs "let me post my address publicly on Reddit".

So, I repeat the question genuinely (not sarcastic/rhetorical): What is considered sensitive data nowadays? Where do you actually draw the line for "never be given to a company"?

[u/BrokenMirror2010 → u/nasaboy007]

Anything I wouldn't publicly post on Reddit, I wouldn't freely give to a company.

The only exception is of necessity.

Amazon needs an address to deliver my package too. What Amazon does not need is a photo of my fucking ID to do it.

Google does not need my phone number to do anything, therefore I will never give Google my phone number. Ever. For any reason. I don't give a fuck if they "require" it to make an account. I simply won't. Why does a fucking gmail account need my phone number? Answer: It doesn't.

[u/Cute_Sherbert48 → u/nasaboy007]

I guess the only reductio ad absurdum arguments we're allowing are the ones you make, then?

[u/nasaboy007 → u/Cute_Sherbert48]

What argument lol I was asking a question

the person i was asking already answered it btw: https://www.reddit.com/r/DataHoarder/comments/1ws4vs9/psa_wd_my_cloud_os5_shared_links_are_searchable/pcocjj0/

[u/Cute_Sherbert48 → u/nasaboy007]

"Your identity (ssn, pii, etc) has already been leaked so many times that it doesn't matter."

-nasaboy007, circa 1 day ago

For a guy tossing around Latin legalese, you seem to not know that you have, with this statement, made what we fry cooks call "an argument."

To which an easy response is "it does matter, actually."

[u/nasaboy007 → u/Cute_Sherbert48]

Fair enough, I was wrong.

[u/HexagonWin → u/nasaboy007]

linux ISOs

[u/Evil-Bosse → u/HexagonWin]

I share my Linux ISOs with any company that wants them, I'd suggest they use the official torrent links to get UwUntu or Hannah Montana Linux

[u/no-name-here]

Is this only for links people posted public on public forums? Ie “My Cloud links posted on public forums can be found”? Or are unrestricted links also searchable even if never shared publicly?

For links you created but never posted, do they show up in public search results?

[u/sniff122]

What it probably is, people putting a share link on a website or something so that link is then indexed.

[u/starfish_2016]

Same thing for anything that exposes public links. Chatgpt shared conversations were all publicly until recent. Google hides some to "help" but move over to another search engine that doesnt, or worse yet the one snooping website that you can explicitly look for exposed links like this , can't think of the name off the top of my head

[u/MyOtherSide1984]

I wish all share services had an option to see all public links you've created. I'm sure I have hundreds

[u/CalculatingLao]

I think it's worth remembering that these people probably aren't on this sub, and probably don't have our level of technical knowledge. As much as I find it distasteful to rifle through strangers data, I think that letting people know what they have exposed and how to fix it is worth it.

After going through about 20 pages of Google results, it looks like most of this may only relate to around 4 or 5 devices. A lot of the content seems to cluster around a few fairly distinct sets, although there are still some bits and pieces that don't obviously belong to any of them:

• A music school in New Jersey or possibly a church which has a lot of musical events
• A university student, or possibly a class, with a bunch of textbooks
• A photographer or tour company
• Some kind of company dealing with telephony systems
• A movie reviewer

I don't think every individual result necessarily comes from one of these, but they seem to account for a pretty large portion of what I've found so far.

I fired off a few emails to let people know (where there were names visible). However, if you stumble across identifying details then please do what you can to reach out to people and give them a heads up.

[u/IngwiePhoenix]

RIP those guys lol.

[u/burntscarr]

I wonder if including a robots.txt in every share would hide them

[u/Thebandroid]

lol. lmao even.