1. SSH to the box

2. Username: hpsupport

3. Password (from SHA1 lookup): badg3r5

Yes that shit.

We have some of this kit in and I've tested it and it works absolutely spot on. Fortunately it's all firewalled off but it's not the sort of crap you want on your doorstep.

Nothing to do with the NSA this - just a crappy decision somewhere which is designed to make HP support's life easier. As someone else said: this bug is as old as time.

Welcome to the 80s. Seems like software development is moving in circles

Can you do me a massive favour and paste the output of the following commands?

uname -a

cat /proc/cpuinfo

cat /proc/meminfo

cat /etc/passwd

If I can get a firmware image I'll take a look early next week and do an analysis follow-up.

I just don't understand why companies are still pulling this crap. It puts their customers at risk.

Because their customers are the pointy-haired-bosses who're asking "Why the hell to we need to wait for them to send a service tech out? Why can't they fix this online?" when shit is actually going down - rather than the network/storage/security guys who point out the risks of things that haven't happened yet.

Yea, but techies should at least use PKI with HSM guarding the private key, not 7-char almost-dictionary-based password.

But it has numbers replacing the letters! That makes it hard for computers to guess!!!

Oh, right. Sounds like the pointy-haired boss decided upon the password himself.

Well, so I won't tell you about the vendors that give you the stare if you change the root password on their devices from the factory default. Like, "You changed the sysadmin password? Why?"

~sigh~

Misleading article title. (What better to expect from The Register?) HP admitted there's a vulnerabiity that with customer provided access and permission can allow HP support to access underlying os of the storage device. At most a reboot is possible not data access. So this is just another stupid vulnerability that'll be fixed soon - not a backdoor.

" … with customer provided access and permission can allow HP support … "

Which, cynically, could easily be read as "with the storage device on a network, and with a company policy requiring support staff to request permission before using it".

Maybe these things aren't _intended_ to be directly internet connected - but there's a _lot_ of gear that ebds up that way without ever having been designed too. Even HP admit: "This vulnerability could be remotely exploited to gain unauthorized access to the device."

And from the end of the article - it seems at most: "And, of course, there's the "reset factory defaults" option, which would nuke all a user's data." - still not a "backdoor", but somewhat worse than just "a reboot".

HP are lying. The article title is correct. You can use many well known kernel vulnerabilities to get root on the box after logging in as hpsupport. At that point you can do block reads off anything you want.

I would say otherwise, seeing as that it was a known vulnerability, and left in intentionally. Very much a backdoor.

Why "intentionally". May be it was put there intentionally but leaving it that way was a mistake. I don't think that's a backdoor, just from the article.

I would say that both malice and stupidity of HP are well balanced in this case.

It doesn't say it was left there intentionally. We don't have (or this article does not give) information enough to call it a backdoor.

Accidentally leaving an open administrator account is a bug as old as time. I won't necessarily attribute it to malice.

That said, it's still a backdoor, whether it was left there intentionally or not. I'd have a hard time trusting HP products after this.

Sadly our parent company uses HP to handle all security and computer support/installation. Around here they are known as Helpless People.

HP nicely covering their ass to not get associated with the NSA scandal happening at the moment. I don't know if the fact that they are trying so hard is an indication that they actually are but this is suspicious.

It's not smearing when it's true. Just plain old exposing.