[anonsec123]

Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware.

[nobody9999]

>Western Digital has likely been compromised for years. I would be real concerned about their windows drivers and device firmware.

What evidence do you have for this? Not being snarky, as I have a whole bunch of WD drives.

Please do tell. Thanks!

[rasz]

2015 https://sites.psu.edu/ist110pursel/2015/10/24/my-passport-se...

2017 https://www.bleepingcomputer.com/news/security/owners-of-wdt...

2017 https://blog.exploitee.rs/2017/hacking_wd_mycloud/

2018 https://www.theregister.co.uk/2018/01/08/wd_mycloud_nas_back... https://www.bitdefender.com/blog/hotforsecurity/researcher-f... https://www.techpowerup.com/240306/western-digital-ships-som...

"However, since more than 6 months have passed with no patch or solution having been deployed, the researchers disclosed and published the vulnerability, which should (should) finally prompt WD to action on fixing the issue."

[nobody9999]

Thanks!

That's not very flattering, and if I used any of those products/software features (I have only bare, internal SAS drives, both spinning rust and SSD) I'd be really concerned.

Since I only use bare internal drives, I imagine I'm not at risk (although, I've had one or more of these drives for at least 7 or 8 years -- so if I was at risk, you'd think that would have happened already) from the vulnerabilities noted in the links you provided.

But I'll do some research (although I do try to keep track of such things and never heard anything about actual drive firmware -- rather than the NAS/cloud products -- being compromised.) anyway.

Thanks again for compiling these links and sharing them. Much appreciated!

[DANmode]

Have you used their software?

[nobody9999]

No. I always format every hard drive I buy, but GP asserted that their firmware has likely been compromised for years.

That's a strong statement, unsupported by, well, anything.

Not saying it isn't true -- and if it is, I want to know about it -- as it puts my systems at risk.

[djbusby]

Crappy don't necessarily mean security-compromised

[DANmode]

But it is a smell.