FOLLOW US

Western Digital, the San Jose-based computer hard drive, and data storage manufacturer issued a statement on Wednesday. It advises My Book Live customers to disconnect the device from the internet. 

My Book Live devices connect via an Ethernet cable to the internet.  My Book Live is actually a network-attached storage device. It looks similar to a book that you can stand on your desk in a vertical position. The high-end cloud storage device allows users to centralize and share media on their home network. Users are able to wirelessly back up computers and access their files from any device. 

Bleeping Computer, reported that Book owners were being affected internationally. Many users were discovering all their files were mysteriously disappearing. 

Terabytes of data, months of work, and years of memories were instantly deleted.

Users weren’t able to log into Western Digital’s cloud infrastructure to diagnose the issue. Because many of their passwords were no longer working. When users tried to log in via an app or the Web dashboard, they received the error message "Invalid password."

My Book Live Community Forum lights up

Many of the users were puzzled, then panicking. And headed to the WD Community Forum to submit tickets and get help.

"I have a WD My Book live connected to my home LAN and worked fine for years. I have just found that somehow all the data on it is gone today, while the directories seem to be empty. Previously the 2T volume was almost full but now it shows full capacity," a My Book owner reported.

"The even stranger thing is when I tried to log into the control UI for diagnosis I was only able to get to this landing page with an input box for “owner password”. I have tried the default password “admin” and also what I could set for it with no luck."

And hundreds of users hit the Forum yesterday. They all had the same complaints. 

Remote Factory Reset

The My Book Live users were quick to point out that their MyBook logs showed devices had received a remote command to perform a factory reset. It started at around 3 PM on June 23rd and proceeded through the night.

 QNAP devices are commonly connected to the Internet and exposed to ransomware attacks such as QLocker Ransomware. But My Book Live devices are stored behind a firewall and communicate through private cloud servers to allow remote access.

Some users hit by the attack are concerned that Western Digital's servers were hacked so a threat actor could end a factory reset command.

If a threat actor was using ransomware to wipe devices the company should have gotten ransom notes or other threats. The factory reset indicates these malicious and destructive hackers. And there is speculation that the attack was not for profit.

Western Digital believes the attack was caused by malware that compromised the system using an unpatched vulnerability. The company hasn’t explained how the attack infiltrated the servers. The investigation is ongoing.

Western Digital is urgently asking all users to disconnect the My Book NAS device from the internet now.

"At this time, we recommend you disconnect your My Book Live and My Book Live Duo from the Internet to protect your data on the device," Western Digital said in an advisory.

Western Digital statement

"Western Digital has determined that some My Book Live devices are being compromised by malicious software. In some cases, this compromise has led to a factory reset that appears to erase all data on the device. The My Book Live device received its final firmware update in 2015. We understand that our customers’ data is very important. At this time, we recommend you disconnect your My Book Live from the Internet to protect your data on the device. We are actively investigating and we will provide updates to this thread when they are  available.”-Western Digital