Western Digital is urging customers to update their WD My Cloud devices to the latest available firmware to keep receiving security updates on My Cloud OS firmware reaching the end of support.
The company stated that on April 15, 2022, support for prior generations of My Cloud OS, including My Cloud OS 3, will end. If the devices are not compatible with My Cloud OS 5, the users will lose remote access and will only be able to access it locally. Devices on these older firmware versions will not receive security fixes or technical support.
Western Digital advises customers to protect their data from attackers after the firmware is no longer supported by backing up their devices, disabling remote access, disconnecting it from the internet, and choosing a unique and strong password.
Those who have eligible devices can update them to My Cloud OS 5 (which will be supported at least until the end of 2026) before the end of support date.
Those devices that are not compatible with the My Cloud OS 5 firmware can be upgraded to a device that is.
My Cloud OS 5 is a major and fundamental security release that provides an architectural revamp of the older My Cloud firmware and adds new defenses to thwart common classes of attacks.
The company added that they will not provide any further security updates to the My Cloud OS3 firmware.
For details regarding finding if you have a device compatible with My Cloud OS 5, check the Firmware Availability and Supported Devices support page.
In order to upgrade to a supported My Cloud device, in January 2022, the company will send 20% discount coupons to customers with devices that aren’t compatible with My Cloud OS 5 via email.
The users are not required to return their old device to use the coupon, which will be usable for 90 days to buy one of the qualifying products: My Cloud Home (8TB), My Cloud EX2 Ultra (16TB, 24TB, 28TB) or My Book (12 TB).
To underscore the risks of running unsupported firmware, in July, Western Digital warned of ongoing attacks targeting My Book Live and My Book Live Duo devices.
In some cases, all data from hacked devices were erased after the attackers triggered an unauthenticated factory reset vulnerability (CVE-2021-35941).
The threat actors deployed trojan malware on other compromised devices using exploits targeting a second bug, a critical root remote command execution flaw tracked as CVE-2018-18472.
The vulnerabilities exploited in these attacks were limited to the My Book Live device series that received the final firmware update in 2015.
Image Credit : Tom Antos Films
Comments