ArsTechnica провели расследование истории с Western Digital и удалением данных на устройствах My Book Live. «у нас была одна уязвимость, одна критичная дыра в безопасности и закоментированный код, который не требовал пароля пользователя при заводском сбросе»:
As the following script shows, however, a Western Digital developer created five lines of code to password-protect the reset command. For unknown reasons, the authentication check was cancelled, or in developer parlance, it was commented out as indicated by the double / character at the beginning of each line.
function post($urlPath, $queryParams = null, $ouputFormat = 'xml') {
// if(!authenticateAsOwner($queryParams))
// {
// header("HTTP/1.0 401 Unauthorized");
// return;
// }
https://arstechnica.com/gadgets/2021/06/hackers-exploited-0-day-not-2018-bug-to-mass-wipe-my-book-live-devices/