airdog07
July 17th, 2013, 08:38 PM
HP Admitted Back Doors in Storage Products
Added: Wednesday, July 17th, 2013
HP has recently been forced to admit that the developers built secret backdoors into enterprise storage products. The secret was revealed after a security problem was found in HP’s StoreOnce systems last month. In result, it turned out that there were more backdoors in other HP storage and SAN products.
HP confessed that all HP StoreVirtual Storage systems are equipped with a mechanism that lets its support to access the underlying OS in case the option is provided by the client. It literally means that HP can use the back doors only with permission of the customer.
However, this announcement, coming on the back of the PRISM scandal in the United States, is very surprising, and not without a reason. Actually, if the NSA knows that HP has backdoors in its server, it might use a secret court order to obtain access. According to HP cloud executive, there was already a corporate understanding of the abovementioned privacy questions before the PRISM revelations. Steve Dietch, VP, worldwide cloud at HP, explained that there wasn’t much one can do if the authorities have access to private information while being provided either legally or illegally (based on your country) with access through ISPs.
Technical details are scanty, but it is known that entry points consist of a hidden administrator account with root access to StoreVirtual systems. Nevertheless, HP points out that even with root access, the secret admin account doesn’t allow support techs or anyone else access to information stored on the HP machines. In the meantime, it could still use the data to cripple the storage cluster. The most worrying thing is that a business rival can find one of the backdoors and exploit it as a kind of corporate sabotage.
Actually, the backdoor was quite easy to find. The experts reveal that you can simply open an SSH client, key in the IP of an HP D2D unit and enter in yourself the username HPSupport with a password having a SHA1 of 78a7ecf065324604540ad3c41c3bb8fe1d084c50. You’ll find an administrative account you didn’t know existed and your father’s brother should be called Robert. The experts were fruitlessly trying to notify HP for weeks before making it public that the hash hiding the login was easily brute-forced and has been done more than 50 times. HP promised to release a patch in the next few days.
By:
SaM
Added: Wednesday, July 17th, 2013
HP has recently been forced to admit that the developers built secret backdoors into enterprise storage products. The secret was revealed after a security problem was found in HP’s StoreOnce systems last month. In result, it turned out that there were more backdoors in other HP storage and SAN products.
HP confessed that all HP StoreVirtual Storage systems are equipped with a mechanism that lets its support to access the underlying OS in case the option is provided by the client. It literally means that HP can use the back doors only with permission of the customer.
However, this announcement, coming on the back of the PRISM scandal in the United States, is very surprising, and not without a reason. Actually, if the NSA knows that HP has backdoors in its server, it might use a secret court order to obtain access. According to HP cloud executive, there was already a corporate understanding of the abovementioned privacy questions before the PRISM revelations. Steve Dietch, VP, worldwide cloud at HP, explained that there wasn’t much one can do if the authorities have access to private information while being provided either legally or illegally (based on your country) with access through ISPs.
Technical details are scanty, but it is known that entry points consist of a hidden administrator account with root access to StoreVirtual systems. Nevertheless, HP points out that even with root access, the secret admin account doesn’t allow support techs or anyone else access to information stored on the HP machines. In the meantime, it could still use the data to cripple the storage cluster. The most worrying thing is that a business rival can find one of the backdoors and exploit it as a kind of corporate sabotage.
Actually, the backdoor was quite easy to find. The experts reveal that you can simply open an SSH client, key in the IP of an HP D2D unit and enter in yourself the username HPSupport with a password having a SHA1 of 78a7ecf065324604540ad3c41c3bb8fe1d084c50. You’ll find an administrative account you didn’t know existed and your father’s brother should be called Robert. The experts were fruitlessly trying to notify HP for weeks before making it public that the hash hiding the login was easily brute-forced and has been done more than 50 times. HP promised to release a patch in the next few days.
By:
SaM