One fine start to a day, Western Digital (WD) My Book Live NAS proprietors woke up to all cleaned and erased data. Petabytes of information or data were cleared off from the platform within no time. Meow attacks are those where attackers literally nuke unprotected data sets to erase records. It’s anything but an uncommon event in 2020. Has WD become a casualty of one of those assaults?
Making it the breaking news
A baffling group quickly gave command of factory reset for every one of the records relating to Western Digital’s MyBook Live and Book Live DUO clients, keeping them out of their gadgets.
- At first, specialists highlighted an unaddressed vulnerability from 2018, followed as CVE-2018-18472, proposing it was the underlying driver behind the fruitful interruption
- Further examination concerning the matter uncovered that hackers misused a zero-day, presently being followed as CVE-2021-35941, to erase data
- As per WD, the said vulnerability was presented in 2011, a year after the drives were presented
- While the primary vulnerability worked with attackers with root access, the other one could transform part of gadgets into a botnet
Specialists’ situation on Western Digital
Specialists have affirmed that the attackers abused both the glitches in nature. In any case, they couldn’t comprehend:
- For what reason did programmers transform My Book Live gadgets into a botnet, then, at that point wipe and reset everything?
- For what reason did there arise a requirement for client verification sidestep when they previously had root access?
Specialists believed that the mass wipe and reset were presumably performed by different cybercriminal gangs and they could be rivals.
Also read,
On the off chance that the hypothesis remains constant, this occurrence stands apart as an exemption for Meow assaults. As of now, more information on the occurrences is anticipated.
Data wiping threats, aka meow attacks, have returned after a hiatus of about a year. Not installing patches for identified flaws for months or years is a sign of organizations’ lax approach toward data security. The device maker, meanwhile, has advised users to immediately disconnect their devices from the internet.
Threats of data erasing, also known as Meow attacks, have returned after a break of about a year. Not downloading and installing the patches for recognized defects for quite a long time or years is an indication of associations’ remiss methodology toward data security. The gadget producer, in the meantime, has encouraged clients to promptly separate their gadgets from the internet.
