Western Digital NAS drive owners told to unplug their devices after malware attacks

Company confirms spate of factory resets were triggered remotely

Western Digital has confirmed that its My Book Live network-attached storage devices are being targeted with malicious software capable of wiping terabytes of data.

The statement follows complaints from multiple users who said their NAS drives had been mysteriously wiped overnight.

Upon further investigation, users revealed their My Book Live NAS drives had received a remote command to initiate a factory reset. It's believed commands started going out at around 3 pm PDT (11 pm BST) on Wednesday, with one user detailing how they “tried to access some files via the iPhone app but got an error message saying ‘unable to connect’”.

At first, the user “assumed it was just a Wi-Fi/network issue”.

“But when I tried to access the drive from my PC using a shortcut everything was gone except for (empty) default Public folders: Shared Music, Shared Pictures, Shared Videos and Software. The time stamps on those folders say they were created at 00:16 (UK time) this morning. There is also a .tickle file created at 00:17. I can’t log into the UI on the device as it says my password is invalid,” they added.

Another My Book Live user said that they found the following script in the user.log of their drive:

“Jun 23 15:14:05 MyBookLive factoryRestore.sh: begin script:

Jun 23 15:14:05 MyBookLive shutdown[24582]: shutting down for system reboot

Jun 23 16:02:26 MyBookLive S15mountDataVolume.sh: begin script: start

Jun 23 16:02:29 MyBookLive _: pkg: wd-nas

Jun 23 16:02:30 MyBookLive _: pkg: networking-general

Jun 23 16:02:30 MyBookLive _: pkg: apache-php-webdav

Jun 23 16:02:31 MyBookLive _: pkg: date-time

Jun 23 16:02:31 MyBookLive _: pkg: alerts

Jun 23 16:02:31 MyBookLive logger: hostname=MyBookLive

Jun 23 16:02:32 MyBookLive _: pkg: admin-rest-api”

Following the complaints, Western Digital published a post on the WD Community forum confirming that “some My Book Live devices are being compromised by malicious software” and recommended that users disconnect their devices as soon as possible.

Related Resource

The secure cloud configuration imperative

The central role of cloud security posture management

The secure cloud configuration imperativeDownload now

“In some cases, this compromise has led to a factory reset that appears to erase all data on the device," the company stated. "The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are available."

However, Western Digital didn’t elaborate on who might be responsible for distributing the software, or whether the company itself has been compromised by a cyber attack.

IT Pro has contacted the company and will update this story when more information becomes available.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

How to use machine learning and AI in cyber security
Security

How to use machine learning and AI in cyber security

30 Jul 2021
Chipotle’s marketing email hacked to send phishing emails
phishing

Chipotle’s marketing email hacked to send phishing emails

29 Jul 2021
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

29 Jul 2021
Colonial Pipeline hack spurred copycat attacks on other oil and gas companies
hacking

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies

29 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021