(benjamin lehman/Unsplash)
A little over a year ago, I made the case that, by making consumer electronics “smart” and internet-connected, we were actively putting an end date on their usefulness that simply did not need to be there.
And a story this past week around the hard drive manufacturer Western Digital really highlights how bad this can really get.
Western Digital produced a series of external hard drives under the name WD My Book Live. These were built to be connected to the internet as network attached storage, and include a built-in processor and no USB ports (as they connect to Ethernet only). And while the drumbeat of technology has passed them by in favor of more robust NAS options or even SSDs, they still are likely to work perfectly well for their use case of long-term storage.
The problem is that Western Digital stopped officially supporting them back in 2015, despite the fact that network-attached storage is often intended to last many years. So when a security exploit came along that Western Digital didn’t bother to fix, hackers eventually noticed this—and took advantage of it to hack these devices, which, again, are designed to connect through ethernet alone.
Ars Technica has the gory details, and man, they’re bad:
“I have a WD mybook live connected to my home LAN and worked fine for years,” the person who started the thread wrote. “I have just found that somehow all the data on it is gone today, while the directories seem there but empty. Previously the 2T volume was almost full but now it shows full capacity.”
Other My Book Live users quickly joined the conversation to report that they, too, had experienced precisely the same thing. “All my data is gone too,” one user soon responded. “I am totally screwed without that data … years of it.”
As I noted in my piece about Sonos dropping support for its early devices, in one sense you can kind of forgive Sonos for it in that the company released the hardware at a time when it was just a startup and likely had no clue that it would be in a position to maintain support for equipment more than a decade on.
(yum9me/Flickr)
Western Digital, a company that primarily sells hard drives and SSDs and has been around in one form or another for more than half a century, has no such excuse. They knew the market they were in and the use case this was intended for. The decision to not support long-term security updates on a device that was intended for long-term storage raises some serious questions about the way that the company approaches hardware updates.
Yes, a NAS with decade-old guts is not going to be as useful a decade after the fact. But given that this is a piece of hardware that is put into homes or networks and intended to “just work,” there appears to be a major disconnect between Western Digital, the manufacturer, and the consumers who likely intend to use products like these for a long period.
The exploit was reported to the company three years ago, and Western Digital did not exactly have a glowing response in regards to the report:
The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012. These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle. We encourage users who wish to continue operating these legacy products to configure their firewall to prevent remote access to these devices, and to take measures to ensure that only trusted devices on the local network have access to the device.
(I imagine the people affected by this exploit did not see this message.)
Perhaps companies should not have to support old devices forever, but this to me very much seems to be a case of WD pulling the plug on supporting a device well before many of its users had actually gotten a useful lifecycle from the device.
What the company is doing is clearly not working—Sonos, the subject of my article from last year, supported its smart devices (targeted to a similar serious-consumer market as the WD My Book Live devices) for more than a decade, well beyond the point Western Digital cut off security updates.
And because of that, a lot of people will probably never buy a Western Digital product ever again. Heckuva job.
Update (06/29, 11:30 am ET): I’m shocked I have to say this, but it gets worse.
Time limit given ⏲: 30 minutes
Time left on clock ⏲: 1 minute, 23 seconds
