![]() Twonky Server allows access to My Cloud users within the local network without password protection, which is common with DLNA server software. “My Cloud systems come with Twonky Server. Western Digital told Threatpost that the DLNA feature is used in conjunction with users’ media players on smartphones and TVs. If My Cloud is on a closed network or happens to be on the open internet (and the vulnerable port 9000 is open) then an attacker anywhere can access every single file on the appliance,” Karl Sigler, threat intelligence manager at Trustwave SpiderLabs, told Threatpost in an interview. You don’t have to get the credentials ahead of time. ![]() Instead, WD only recommends users turn off DLNA “if they do not wish to utilize the product feature.” Researchers said that when they disclosed to Western Digital their research the company said the insecure default settings did not warrant a fix. “By default, unauthenticated users can grab any files from the device completely bypassing any permissions or restrictions set by the owner or administrator,” wrote Martin Rakhmanov, security research manager at Trustwave in a technical analysis of the My Cloud EX2. Researchers said the leak is due to the device’s UPnP media server that is automatically started when the device is powered on. On Wednesday, Trustwave released its findings, warning, “unfortunately the default configuration of a new My Cloud EX2 drive allows any unauthenticated local network user to grab any files from the device using HTTP requests.” If configured for remote access via the public internet, the My Cloud EX2 also leaks files via an HTTP request on port 9000, according to researchers at Trustwave who first identified the leaky port. I hope this changes as otherwise it i s a really nice device.Western Digital’s My Cloud EX2 storage devices leak files to anyone on a local network by default, no matter the permissions set by users. This could easily be addressed by an update to the server firmware (which has been updated for other devices many times since, and is now in v.6), but WD have not released any firmware updates in 2010, and cannot give a time frame if and when such an update is likely to occur. This is a very real shame, as otherwise the drive is nice and quiet, and works well. So, Yamaha network receiver owners be warned - a WD My Book World Edition NAS drive will not work as a streaming DNLA device, due to outdated Twonky media server firmware (v.5.1). Sadly, therefore, the WD My Book World Edition will be winging its merry way back to Amazon for a refund. ![]() My own attempts to deal with WD customer service also bore no fruit, with me being told that there is no estimated time of release for a new firmware update. I have been using their ‘support’ forums, and people have been requesting an update since January 10. The sad news is that Western Digital do not seem in the least bit interested in creating an update. Well, they wlll not profit by me and I will be seeking an alternative from some other manufacturer. It has now been quite some time now since the issue was raised (I believe the Media Server is now in v6!), so I’m afraid the message it sends is that Western Digital don’t really care about the issue. There have been claims that the media server would be updated - no promises of firm dates. Given that I bought this to replace a failing Buffalo NAS which had no such problems, this is pretty poor as a major function (media streaming) simply does not work. Seems the Yamaha 2065 can be added as a device which Twonky 5.1 on the WD NAS does not work with. I was going mad, thinking it was a router fault (i suppose it could still be?) and have been posting to different forums for any suggestions or help. Streams ok with PS3 and 360, but my Yamaha 2065 (DNLA compliant) will not stream/render files from the My Book. Looks like it will be going back for a refund asap. I bought one of these ‘great white hopes’ on Saturday.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |