Another 0-day looms for many Western Digital users

turns out it was leeching power from another still-active device through its data pins!

there was not enough power flowing through this way to actually do something, but there was enough to keep the brownout detector from kicking in and resetting the chip

In related news, I used an old Android phone and DroidCam over USB as a webcam. The picture quality is stellar, much better than any webcam you might find, and it's very simple to stop it by unloading the driver (I know, I know...).

Because paying customers don't understand or care about privacy.

Facebook is still a thing. Let that sink in.

BTW, I would read TV repair manuals as a kid (yes, weird). There was always the "check to see if it is plugged in". Plugging TVs in made a lot of money for service people.

I see similar things in car manuals for car won't start. "Put gas in it."

Edit: This was back in the days when you could repair a TV with a soldering iron and a screwdriver. Every hardware store had a tube testing machine. I'd have fun by randomly swapping the tubes that fit in the same socket and seeing what effect that would have on the TV's operation.

The answer to "Did you check the wifi switch?" is almost always "What wifi switch?".

Pretty much the only way this might be possible is if you had an audio port that was capable of functioning as both a TRS output and a TRS input (not a TRRS "headset" port), and had a set of headphones plugged into said port, and had a piece of malicious software that was able to reconfigure the port to act as an input.

If there's non-secret hardware inputs on the speakers... it's probably easier to just remove that.

No, it’s not. The actual low-level chip on the flash has a separate pin that must be connected to ground to enable writes.

Most flash chips have a write-enable line that you can put a switch on. Usually have to cut a trace but often can avoid soldering right to the legs by following traces.

Was a common thing to do to receivers (“Integrated Receiver Decoders”) back in the paytv days. Thankfully they had firmware on a parallel eeprom and config stuff on a smaller serial eeprom (that could handle 1m writes instead of 1k writes). Receivers could have a lot of wires especially after they implemented some lock-detection that had to be countered with some 74ac logic that could disrupt the 2nd step of starting a write job.

Should be doable for something like a router or cable modem, but maybe not on something like these WD drives. Like a mod chip without having to worry about the vendor trying to counter you.

Of course you’re still screwed if something is only non-persistent but at least any issues are resolved with a simple reboot.

First, some internal boot ROM, likely with fuses burned in for the particular IO configuration, reads a bootloader (likely Das U-boot) from external flash memory. That first-stage bootloader initializes the parallel/SPI NAND/NOR flash interface and DRAM controllers, and then launches the second-stage bootloader. The second-stage bootloader uses those memory controllers to read the firmware image out of memory into RAM, then executes it.

If you want to update the firmware - more precisely, to change the location or signature of the image that should be loaded by the second-stage bootloader - it would be trivial to add a check for a GPIO switch to allow or deny changes.

Before EOL auto-update is a vulnerability, and after EOL security patches might still be made available for the absolute worst vulnerabilities, but now wouldn't get to practically anyone.

The issue is that, for me anyway, it's often easier/faster to just set up something myself. Most of the time it's a "configure once"-thing and then it "just works" with just the occasional updates.

And if something does tend to go awry it's usually easy to diagnose and fix. If something goes wrong with one of those NAS black boxes it tends to be much more complicated. Or if I want to add $feature_x this tends to be fairly easy as well.

Of course, this vastly depends on your skill and what you use it for: I don't have a mac so I never tried Time machine. My point is just that for some of us at least, "building their own" is actually done for the same reasons: I want to spend as little time on this as possible.

Synology are pretty neat machines last I checked them out though, we used to sell quite a few of them (over 10 years ago). I stopped using my CentOS "NAS" when I moved a few years ago, but if I were ever to be interested in buying one I'd probably consider it as an option.

You also have the problem of getting every user of the product to flash some custom OS on their hard drive when they likely don't know how or don't know why they should care.

I have a gigabit connection and am disgrunted that I can't self-host most services I need without turning it into a 2nd job

It's not the best solution, but it works reasonably well with little maintenance on my part. On Windows you can set a smb drive to mount automatically at boot and it'll behave like a normal drive. So it was easy to explain to them that you can access that folder from both machines simultaneously.

I agree that this is not a good solution for someone that has to set it up themselves. In that case I'd recommend something like a Synology unit.

I have a friend whose grandparents took tons of film of him growing up. Then their house burned down, all lost. Give a backup to an offsite family member.