Hacker News Reader

Comment by ineedasername | Hacker News Reader

Of course they issue a CYA about their cloud systems not being compromised, but then bury the fact that other systems were compromised by using the passive voice when they point to "threat actors".

I'm assuming the My Books phone home in some way to facilitate file access over the internet. If so, that WD system got cracked. That seems more likely since-- at least for my ISP and I'm guessing most home ISPs-- don't expose individual device ports to the world unless the user sets NAT for that.

Anyone know if NAT configs are required to use the feature that let's you access files from anywhere? If so, someone simply cracked bad security 6 years out of date and scanned for devices.

Given typical IoT security, it might only have been using the default user & password.

View on HN

The vast majority of users assuredly have an Internet connection they already use with at least one other machine on it, so unless ISPs are handing out another public IP for their NAS, it's almost certainly behind a NAT.

If so, someone simply cracked bad security 6 years out of date and scanned for devices.

Maybe the majority of them aren't so much an "exploit" as they are "easily guessed credentials". The fact that anyone else, anywhere else on the Internet can also use those same credentials to access their data is something that probably few people realise when they set one of these things up.

These devices typically callback to the server and stay connected. Since the client is initiating the connection, there is no incoming NAT necessary.

Judging by the CVE they linked, you need local access. But, since it's a GET parameter, this could be a drive by attack where someone puts all the links to common home networks in a page and the browser just takes care of that (and there are ways to guess the local network). Though, judging by the number of people affected, it might be something else.

> Anyone know if NAT configs are required to use the feature that let's you access files from anywhere?

I doubt it. The specs list UPnP support. DLNA on some versions too. No consumer device is going to expect the average punter to mess with NAT.

I wasn't sure because apparently there can be issues with multiplayer or online play with some game consoles and people will be directed to mess about in their router settings. There were some stories about problems with the Xbox like that.

Reply on news.ycombinator.com