The IT Nerd

This review started off in a weird way. A client of mine bought this at Best Buy because he saw some of the marketing claims on the box and figured that the Western Digital My Passport SSD in the 1TB size must be fast. But when it didn’t “feel” fast to him, he asked me to look at it because he figured that it was him and not the drive. Well, the short answer is that it’s the drive. But before I get to what I mean by that, let me give you a look at the drive in question:

In the box you get the drive (you do get to choose between 5 colours), a USB-C cable, and a USB-C to USB-A adapter. This is a good start as USB-C is used on the drive which means that getting replacement cables will be easy. On the drive itself is backup software which is likely more useful for PC users than Mac users who should use Time Machine instead. Though they will have to format the drive before that as the drive comes out of the box formatted for ExFAT. The drive itself is light despite being made of metal and feels solid enough. It claims to be shock resistant up to a 6.5 foot drop. Though I did not test that. And when I tried transferring files to it, it got warm to the touch. Which is fine as I have seen SSD drives get hot to the touch. This drives also supports 256-bit AES hardware encryption for those who are paranoid about keeping their data safe.

Now over to the testing part. Here’s a picture of the box that it came in so that I can show you the speed claim that Western digital makes:

Note the part that it says “Up to 1050 MB/s”. Flipping the box over and reading the fine print, they’re referring to read speed. And looking at the Western Digital website the company also says that it has up to 1000 MB/s write speeds. Those are very bold claims. But here’s what I got when I plugged the drive into my M1 Pro MacBook Pro which has Thunderbolt 4 via the included USB-C cable:

So I was able to confirm that Western Digital was correct on the write speeds as it hit 967.38. But the read speeds was significantly slower than what Western Digital claims. As in around 25% slower. I repeated this test on a PC with Thunderbolt 3 via the included USB-C cable and got similar results. So that suggests that it’s not the computer or the cable that’s responsible for those read speeds. Or lack thereof. It’s the drive that’s responsible. But to be fair to Western Digital. They did say “up to” so just like ISP’s who use that term to cover themselves when the Internet connections aren’t up to the speeds that they advertise, Western Digital has covered themselves. But this explains why the client felt the drive was “slow.” A 5% or even a 10% difference in read speed would likely not have been noticed by most people. But 25% will be noticed by most people. Also to be fair to Western Digital, this speed doesn’t suck. But it doesn’t measure up to the claims on the box.

Now does that mean that you should not buy this drive? As long as you’re not expecting the drive’s read speed to match what’s on the box, go ahead. It’s MSRP is $100 CDN so it’s not a lot of cash to spend. Just make sure you buy it direct from Western Digital or shop around as buying it from Best Buy will cost you $30 more for no good reason.

I’ve been tracking a story about Western Digital for the last few days that broke via via Ars Technica. The story goes something like this:

As users have reported online, including on Synology-focused and Synology’s own forums, as well as on Reddit and YouTube, Western Digital drives using Western  Digital Device Analytics (WDDA) are getting a “warning” stamp in Synology DSM once their power-on hours count hits the three-year mark. WDDA is similar to SMART monitoring and rival offerings, like Seagate’s IronWolf, and is supposed to provide analytics and actionable items.

The recommended action says: “The drive has accumulated a large number of power on hours [throughout] the entire life of the drive. Please consider to replace the drive soon.” There seem to be no discernible problems with the hard drives otherwise.

Synology confirmed this to Ars Technica and noted that the labels come from Western Digital, not Synology. A spokesperson said the “WDDA monitoring and testing subsystem is developed by Western Digital, including the warning after they reach a certain number of power-on-hours.”

There’s a couple of ways to look at this.

Let me start with the cynical view. I have zero issues with a hard drive giving you a warning if the drive is about to fail. Especially if you use it in a Network Attached Storage box or NAS like the ones that Synology makes as that is mission critical use case. And drives have had technology built into them to warn you of a potential failure for years. That tech is called SMART or Self Monitoring Analysis And Reporting Technology. But Western Digital’s tech that seems to be designed to throw up a warning after three years of usage. Which by some strange coincidence is around the time the warranty on a lot of these drives expire. That seems a bit “sus” to me. It’s almost as if Western Digital is trying to scare people into replacing drives to drive their revenue upwards.

Here’s the charitable view. There’s a figure called MTBF or Mean Time Between Failures. This is a statistical model that estimates the average life span of a hard drive. A lot of this depends on how you use the drive. The generally accepted MTBF figure that I’ve always seen is three to five years in terms of what users should expect. In a NAS environment, you’re likely to be closer to that three year end of the spectrum. Which means Western Digital warning you about the fact that the drive is over three years old may be a good thing as a surprising number of people have a tendency to not only install and forget about NAS boxes, but they don’t back them up either. Which means a drive failure can be catastrophic.

Pro Tip: You should back up your NAS either to an external drive on a frequent basis (as in at least monthly if not more frequently) and store that backup off site. Or you should use a service like BackBlaze to back up your NAS to the cloud.

If you want my personal opinion, I don’t think that Western Digital is doing anything wrong here. Though there is a part of me that thinks that this is still a bit “sus”. But what I do think is that they did a horrible job of explaining what WDDA does and why it’s potentially valuable to end users. Having said that, these issues would have likely gotten in the way of explaining that:

• The fact that Western Digital was pwned by hackers not too long ago.
• A class-action lawsuit related to Western Digital quietly switching some of its Red NAS drives to shingled magnetic recording (SMR) tech which holds more data per disk by overlapping data at the cost of write speed and longevity.
• Sub brand SanDisk having issues with their disks erasing themselves.

In short, it is possible that even if Western Digital did a better job of rolling WDDA out, nobody would trust them anyway because of the above issues. And that reflects poorly on Western Digital which in my mind means that they need to address not only this specific issue, but the trust that users have of their brand overall as clearly it’s pretty bad at the moment.

Now some people have recommended against buying Western Digital drives because of this. At the moment, I am continuing to recommend those drives to my clients. But I have to admit that when I replace my NAS later this year, I’ll be looking at installing Seagate drives because while I have not had any of my personal Western Digital drives fail, and only one client over the last decade or so has had a Western Digital drive fail, this whole controversy has made me broaden my horizons. And if I have a good experience with Seagate drives, I will likely start recommending them to my clients as well. Which I suspect is the last thing that Western Digital wants. But given the state of play at the moment, until they come out and address this head on and transparently, that’s what they are likely to get. I say that because I am unable to find any example where Western Digital has said anything about this in public. Perhaps they’re hoping that this issue simply goes away? Who knows? But I do know that companies that don’t deal with issues head on end up with a bad outcome at the end of the day. And Western Digital has to decide if that’s what they want.

Your move Western Digital.

Something that I tell clients all the time is that “the cloud” is just someone else’s computer. Which means it is subject to all the problems that one can have with a computer. Including the fact that it can get pwned by threat actors. A case in point is the fact that hard drive manufacturer Western Digital has been pwned by threat actors three days ago. Though they might have been pwned earlier:

On March 26, 2023, Western Digital identified a network security incident involving Western Digital’s systems. In connection with the ongoing incident, an unauthorized third party gained access to a number of the Company’s systems.

Upon discovery of the incident, the Company implemented incident response efforts and initiated an investigation with the assistance of leading outside security and forensic experts. This investigation is in its early stages and Western Digital is coordinating with law enforcement authorities.

The Company is implementing proactive measures to secure its business operations including taking systems and services offline and will continue taking additional steps as appropriate. As part of its remediation efforts, Western Digital is actively working to restore impacted infrastructure and services. Based on the investigation to date, the Company believes the unauthorized party obtained certain data from its systems and is working to understand the nature and scope of that data.

While Western Digital is focused on remediating this security incident, it has caused and may continue to cause disruption to parts of the Company’s business operations.

And as a result of that pwnage, a bunch of Western Digital services were shut down. You can see the list here. There’s currently no word on when these services may come back up. But that’s not the worst of it. From what I can tell, thousands of people are without their files and Western Digital’s customer service department isn’t keeping its customers updated about what is happening or the progress.

You can read more about what people are experiencing here. But here’s the bottom line this isn’t a good look for Western Digital.

I personally have recommended their hard drives for years. They’re reliable and they haven’t caused myself or any of my clients issues. Their cloud service on the other hand is something I have never recommended. Instead, I direct people towards a service like Blackblaze which is purpose built for backing up your data off site. And I do that because I have never been 100% convinced that what Western Digital is offering would be safe and robust. I believe that I might have been proven right on that front. That’s not to say that Backblaze couldn’t get pwned as well. I guess what I am saying that I have a lot more trust in Backblaze than I do with Western Digital.

A while back I posted a story on a vulnerablity with Western Digital My Cloud drives that was kind of, well, horrific. Today I have another one for you. It appears via a security researcher that Western Digital My Cloud NAS drives have a hardcoded backdoor, meaning anyone can access them and pwn you. The backdoor has the username “mydlinkBRionyg” and the password is “abc12345cba” (without quotes).

Now you’re likely wondering why is the word “dlink” in the username as that should be a competitor to Western Digital. There’s a good reason for that. It appears that the WD NAS devices once shared code with D-Link “Sharecenter” devices. Interestingly, these D-Link devices were issued patched firmware in 2014 and no longer contain the backdoor. Speaking of patches, this backdoor was disclosed to Western Digital six months ago and the company apparently did nothing until November 2017 when it issued firmware 2.30.172. That’s an epic fail and shows that Western Digital isn’t keeping its eye on the ball when it comes to security.

What I recommend to users of the following drives is this:

• MyCloud
• MyCloudMirror
• My Cloud Gen 2
• My Cloud PR2100
• My Cloud PR4100
• My Cloud EX2 Ultra
• My Cloud EX2
• My Cloud EX4
• My Cloud EX2100
• My Cloud EX4100
• My Cloud DL2100
• My Cloud DL4100

First, verify that you’re running firmware 2.30.172. If you’re not, unplug this drive and stop using it until you have upgraded to that firmware. But keep in mind that this issue has been out there for so long, you may have already been pwned and not know anything about it. Thus you may want to question why you want to have a hard drive connected to the Internet in the first place.

If you’re the proud owner of a Western Digital cloud box, I’d advise you to unplug it right now. Why? Apparently, they can be easily hijacked from across the internet or network and there’s no fix for this at present. If that’s not bad enough, the firmware of these devices also has cross-site request forgery vulnerabilities. In English, that means that a malicious webpage can potentially make a victim’s browser connect to a My Cloud device on the network and compromise it. Once that happens, the device and the data on it is pwned.

Here’s a video of the pwnage in progress:

Affected devices include the following:

• 2.21.126 (My Cloud)
• 2.11.157 (My Cloud EX2)
• 2.21.126 (My Cloud EX2 Ultra)
• 2.11.157 (My Cloud EX4)
• 2.21.126 (My Cloud EX2100)
• 2.21.126 (My Cloud EX4100)
• 2.11.157 (My Cloud Mirror)
• 2.21.126 (My Cloud Mirror Gen2)
• 2.21.126 (My Cloud PR2100)
• 2.21.126 (My Cloud PR4100)
• 2.21.126 (My Cloud DL2100)
• 2.21.126 (My Cloud DL4100)

News of this #EpicFail came from SEC Consult Vulnerability Lab which published an advisory on Tuesday after someone named Zenofex went public with full details of the flaws. Here’s the kicker: SEC Consult warned WD back in January that it had uncovered holes in the My Cloud firmware, and gave the vendor 90 days to fix the bugs before it would reveal its findings to the world. Clearly that never happened. But it’s a safe bet with all this negative press that Western Digital is going to fix this real bloody quick. Which is a shame as it should never get to this point before companies do the right thing.