Security News > 2021 > June > My Book Live Users Wake Up to Wiped Devices, Active RCE Attacks

If you haven't already, stop reading and go yank your My Book Live storage device offline, lest you join the ranks of those who woke up on Thursday to find that years of data had been wiped clean on devices around the world.

That was the date of the last firmware update for its My Book Live and My Book Live Duo devices, according to its advisory.

We have determined that some My Book Live devices have been compromised by a threat actor.

The My Book Live device received its final firmware update in 2015.

At this time, we are recommending that customers disconnect their My Book Live devices from the Internet to protect their data on the device.

"Enterprise security teams understand that vulnerabilities come in all shapes and sizes. In the case of the Western Digital My Book Live devices, threat actors took advantage of a daisy chained set of circumstances to wipe the data from exposed hard drives. Consumers should have known to keep the drive firmware patched, and to only connect the drives to the internet when necessary. But, where does the responsibility fall? On the consumer or on Western Digital? There isn't a clear cut answer in this case."

News URL

https://threatpost.com/my-book-live-wiped-rce-attacks/167270/