Leaks In Hard Disk Drives Seagate And Western Digital Unveiled

Researchers have identified vulnerabilities in the hard drives of both Seagate and Western Digital unveiled which no updates are available. Eric Windisch found multiple vulnerabilities in the Central Seagate NAS solutions for networked storage.

It appears that firmware updates are vulnerable to a man-in-the-middle attack, as they are offered over HTTP and are not signed. This allows an attacker located between the user and the Internet is install malicious firmware. Furthermore, the device appears to leak via a phpinfo page information to any unauthorized user information.

Users can also adjust each other's files, there is a general root password used to world-readable, the web application allows unauthorized modification of IP address and host name possible and local users can increase their rights to the NAS. Windisch Seagate inquired twice but got no response. That's why he decided to publish his findings.

Western Digital

In the case of Western Digital were examined different models in the My Passport series that can encrypt themselves. The Western Digital My Passport external hard drive that offers hardware encryption on certain models. Problems with the leaking of information from memory, weak encryption keys and even backdoors on some drives make it possible for an attacker to decrypting user data without a password, the researchers said in their report (pdf).

Thus it appears the hard drives come with a default password. In case the user changes the password and do this once, the key of the default password remains on the hard drive behind. This makes it easy for an attacker to decrypt the hard drive. The problem can be remedied by the password reset a second time, but this is probably not familiar to users.Western Digital has been informed by the researchers, but no solution has yet released.