Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hidden Backdoor Discovered On HP MSA2000 Arrays

Posted by CmdrTaco on from the i'm-your-backdoor-man dept.

wiredmikey writes "A hardcoded password-related security vulnerability has been discovered which apparently affects every HP MSA2000 G3, a modular large scale storage array. According to the alert, a hidden user exists that doesn't show up in the user manager, and the password cannot be changed, creating a perfect 'backdoor' opportunity for an attacker to gain access to potentially sensitive information stored on the device, as well as systems it is connected to."

6 of 197 comments (clear)

  1. Wow... by Ethanol-fueled · · Score: 5, Funny

    The hard coded user and password in the HP MSA2000 is set to: username: admin

    password: !admin

    WaHAHAHAHAH! Not even "n9xe2uPAthe9" or even "Mr.Snuffles". And it is exactly the same as the very generic username, except for one extra character. It's almost as bad(or perhaps even worse) then using "123456" or even "password."

    This further proves that "faith based security" - relying on vendors to provide systems with built-in robust security- is not a good practice.

    Well...nah, I won't even go there. Too easy. I'm trying to be a good boy. Would somebody like to post a sysadmin's prayer for us?

    1. Re:Wow... by mrsteveman1 · · Score: 4, Funny

      Yes but you've now seen the ! so it's NOT admin, we'll have to keep looking.

      Those HP guys are clever.

    2. Re:Wow... by beanpoppa · · Score: 5, Funny

      Steve-"Hey, Frank! What should I make the password for our backdoor admin account?" Frank-"Definitely NOT admin!" Steve-"Ok."

  2. And the password is..... by drsmack1 · · Score: 4, Funny

    cntraltdelete

    If that is too long to type, you can use the shortcut keys on your keyboard. This HP thing goes deep. . . .

    --

    Humor from a Genetically Molested Mind

  3. Hello Joshua ... by tgd · · Score: 3, Funny

    How about a nice game of chess?

  4. That's funny, because by seebs · · Score: 3, Funny

    Whenever you type '!admin' all I see is '******'. Whereas, if I type 'hunter2', all you see is '*******'.

    --
    My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/