Slashdot Mirror
HP Ships Switches With Malware Infected Flash Cards
wiredmikey writes "HP has warned of a security vulnerability associated with its ProCurve 5400 zl switches that contain compact flash cards that the company says may be infected with malware. The company warned that using one of the infected compact flash cards in a computer could result in the system being compromised. According to HP, the potential threat exists on HP 5400 zl series switches purchased after April 30, 2011 with certain serial numbers listed in the security advisory. This issue once again brings attention to the security of the electronics supply chain, which has been a hot topic as of late."
is it?
Hello? Quality Control? Are you there?
The lack of detail regarding the malware (I keep typing maleware for some reason?) makes me want to jump to conclusions. The most fun one has to do with a bored programming intern and pornography, the least interesting is "they screwed something up and are blaming it on someone else."
I have the hiccups.
"The flash card wouldn't do anything on the switch itself but "reuse of an infected compact flash card in a personal computer could result in a compromise of that system's integrity," HP warned in a bulletin issued on Tuesday." http://www.theregister.co.uk/2012/04/11/hp_ships_malware_cards_with_switches_oops/ I think is a LOT more concise and explanatory of the issue.
I have the hiccups.
Malware sure is expensive these days!
Remeber kids, the best things in live are for free
likely the system the loads the image has malware on it and it loads a fat file system and it's running windows with malware that auto copy and installs it self to any disk that it sees
In the future, whats to stop China from controlling everyone's infrastructure if we rely on them to manufacture everything?
I have admiration and sympathy for IT shops that truly try to set up and maintain a secure, productive network. At times, it must seem that EVERYONE and everything are working against you, and your just bashing your head against a wall.
A ready made, turn-key botnet slave in a box, direct from your hardware vendor! Oh Joy! ;-)
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
Parent post spoiled this whole thread by giving away the suspenseful ending.
now we need to go OSS in diesel cars
HP, GE, Dell, Apple, etc. join the list of companies like IBM. IBM showed once before that profits go ahead of morals or loyalty. And it continues to this day.
...still exist!?
It's unclear how the unknown malware got onto the Flash cards that come bundled with the 10 Gbps-capable line of LAN switches, but an infected computer somewhere in the manufacturing process – possible in a factory run by a third-party supplier – is the most obvious suspect.
Regardless of where 'it's' made, it's still HP's baby... Where do I sign up for the class action suit?
A ready made, turn-key botnet slave in a box, direct from your hardware vendor! Oh Joy! ;-)
RTFA or do not post. It was a freaking cheapo flash card from the pachinko loona electric corp .tw that is the problem. You can bet that HP got them dirt cheap. The switch itself is not the problem as the firmware just reads the MS fat file system that the flash card uses and no doubt just stores log data and the like on an external flash. I can just as easily put that same infected flash card on my Linux firmware TV or blueray player and not have problems or even stick into my laptop (which runs Linux) and still not have anything to worry about. However if I stick into a Windows PC like a default XP reinstall with autorun turned on it is a different story.
The moral of the story is HP is cheap and once again they are reselling product from sources that they should more closely monitor. After all it is the responsibility of HP, Dell, IBM, Lenovo and all the manufactures that sell systems to make sure that Windows systems are safe... not Microsoft ;-) The very fact that malware like this still exists and can infect a system tells me that the more older Windows XP systems that get infected the happier Microsoft is.
You don't have to have the hardware made over seas if you home your firmware god-copies on an american made petri dish.
(obligatory windowz suxors reference, proving that anything can be turned into a partisan rant. 8-)
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
having your machines infected with the virus or having spent money on a HP layer 3 switch.
How's that working out? Hewlett and Packard would cry if they came back to see what you've done to their baby.
Honestly, I'd be more worried about the fact that my not-at-all-cheap(and in many environments, not redundant, except at key points, definitely not for individual workstations) switches are booting from a dirt cheap flash card that's had its image loaded with verification so lousy that it missed the viral payload...
I've have a fair number of cheap and nasty flash cards die on me, and that'd be a whole lot more annoying if there were a few grand worth of switch wrapped around the card when it happened(though I can say from personal 'dding-a-working-card-onto-a-CF-card-from-Staples-to-replace-the-boot-medium-of-$3k-worth-of-Alcatel' experience that HP is hardly the only one that does it).
Anything HP can't fuck up?
This, ladies and germs, is a sure indicator that the person or persons in question, herewithto notwithstanding bridal cardiac infarctions, under penalty of perjurious law and tort, is none other than a cliche'-ridden Freudian-angst suffering closet homsexual transvestite. Like Taco. Where is Taco? I miss my Taco.
And if OJ can get, so can this guy, ay Judge Judy-Ito?
A ready made, turn-key botnet slave in a box, direct from your hardware vendor! Oh Joy! ;-)
If you had made last Tuesdays' 2:30 you'd have known that this is a new solution from our vendor to provide ubiquitous control and synergistic integration!
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
I would have thought part of the manufacturing process would have been dd-ing the card with a fresh layout... forget they are cheap cards - electronic parts are cheap, especially in wholesale and the fact your Alcatel/Cisco/Procurve hardware probably got their $.00001 resistors and surface mount diodes from the same place. ... nothing should have survived the write / verify of the media during their final manufacturing/QA process.
120 characters ought to be enough for anyone
Not yet; you have to remember the time difference when calling Shenzhen.
RTFA or do not post. It was a freaking cheapo flash card from the pachinko loona electric corp .tw that is the problem.
Well, I did RTFA.
So, are you saying that a flash card is not part of the hardware? Is the card software or firmware, or is actually a piece of hardware?
Did not HP supply this 'cheapo flash card' with the switch?
So, really, just what is your objection to my comment?
Increase your level of education and improve your reading comprehension to at least a high-school level, or do not post. ;-)
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti