This favorite personal cloud option is currently at risk.
I’m a big fan of personal clouds. Having a physical drive in your own home which you can access from anywhere, just as you would any other cloud service just feels safer. I like the idea that my info is sitting on my own drive, and not on some unknown location on some shared space. Unfortunately, the WD MyCloud, my device of choice, is currently vulnerable to remote attack.
Security researchers at Exploitee.rs have discovered a series of current security flaws in the MyCloud firmware, allowing attackers to bypass the login, insert commands, and upload files. Each of these commands has full access to the operating system.
Sadly, Western Digital did fix one vulnerability which allowed for login bypass, but when they patched this issue, they created yet another.
Exploitee.rs has released these bugs publicly stating they are hoping to force Western Digital to fix the issues quickly. They state that “the company doesn’t pay attention to the seriousness of security flaws”.
As a MyCloud user, I hope this is fixed quickly. In the meantime, all users should disconnect internet access from their MyCloud devices.