Re:WD My Book users wake up to find their data deleted
by terom on Friday June 25, 2021 @06:57AM
(#27629172)
Reading further along in the forum, the `walter` thing sounds like it's only present in test code and comments.
The actual backdoor looks like the `jisoosocoolhbsmgnt` session ID [1] that was removed in the update [2]. It looks like a hardcoded session ID used for tests [3]. Leaving something like that hardcoded and active in the production code is inexcusable.
The actual backdoor looks like the `jisoosocoolhbsmgnt` session ID [1] that was removed in the update [2]. It looks like a hardcoded session ID used for tests [3]. Leaving something like that hardcoded and active in the production code is inexcusable.
[1] https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=495...
[2] https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=555...
[3] https://forum.qnap.com/viewtopic.php?f=45&t=160849&start=495...