Slashdot Mirror
HP Confirms Backdoor In StoreOnce Backup Products
wiredmikey writes "Security response personnel at HP are 'actively working on a fix' for a potentially dangerous backdoor in older versions of its StoreOnce backup product line. The company's confirmation of what it describes as a 'potential security issue' follows the public disclosure that malicious hackers can use SSH access to perform full remote compromise of HP's StoreOnce backup systems. The SHA1 hash for the password was also published, putting pressure on HP to get a fix ready for affected customers. SecurityWeek has confirmed that it is relatively trivial to brute-force the hash to obtain the seven-character password. The HP StoreOnce product, previously known as HP D2D, provides disk backup and recovery to small- to midsize businesses, large enterprises, remote offices and cloud service providers."
instead of talking over a telephone maybe a group of peoples may have to look through billions of lines of coding to really fix this issue outside the halodeck...
So, can anybody think of a not-totally-shameful reason why HP's vendor service backdoor didn't use SSH's keypair auth? Y'know, the one where obtaining the private key just by having access to the public key baked into every unit isn't dangerously trivial?
When did the movie "War Games" come out?
And people are still putting back doors into stuff?
with rainbow tables and no salt it's almost the same as releasing the plaintext: badg3r5
That's the main entrance for the NSA.
Google quickly lead me to the SHA1 of 78a7ecf065324604540ad3c41c3bb8fe1d084c50 and to a publicly available SHA1 reverse lookup utility that already has the match in it.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
I had a set of backups like that once. that's why I dumped NT 3.5
if this is supposed to be a new economy, how come they still want my old fashioned money?
>SecurityWeek has confirmed that it is relatively trivial to brute-force the hash to obtain the seven-character password.
HP is on a low sodium diet, they didn't add salt.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
http://dealnews.com/c72/Computers/Peripherals/Input-Devices/Keyboards/
you need a new one
The best part of clicking on the link to TFA was the pop-over advertisement from HP that said "How secure is your code?"
Way to go HP!
Some of the latest versions of HP P2000 SAN's have a built in service account enabed by default reachable through telnet/SSH that is totally hidden from the management GUI of the device.
https://www.krystalmods.com/index.php?title=hp-msa-g3-array-hidden-admin-user&more=1&c=1&tb=1&pb=1
HP eventually released an advisory about it suggesting you change the password.
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02662287
'potential' security issue
I do not think it means what you think it means.
MU5HR00M MU5HR00M
The first is that it costs more than a king's ransom to buy and isn't that great when you do. So I guess that's three. Sorry.
Who did what now?
it's sad to watch HP fall into ruins, but it seems that me that everything they touch turns into coal instead of gold. They used to build decent hardware. My brother owns an HP handheld from the time before the smartphone craze that had a stylus, Windows mobile (from the era when it actually used to work), a *shitload* of software and GPS. They acquired Compaq and the laptop I bought from them back in 2004 was built to last. Then they phased out all the Compaq products and the laptops they have been marketing since are all crap IMHO. They also killed the Compaq Fortran Compiler with the promise to launch a modernized version for some serious number-crunching on HP-servers that never materialized. When they bought Palm I was looking forward to my new phone that I would buy from them, but all that came out was the half-assed HP Pre 3 and then they dumped that too. WebOS died a shameful death. At home have a long lineage of HP printers and scanners that go back to the Deskjet 1120C from the 90ies that is a parallel port inkjet A3 printer that may still be functional if I tried to revive it. I uses ink cartridges that are the size of my fist and don't dry easily. Shortly after that all they made was give-away printers and all-in-ones that capitalized on the high price of their fart-sized cartridges. Then they stated that they want to offer cloud services, which obviously left me out as their intended audience, but I still kept an eye on them.
And now this story...
Farewell HP, it was good while it lasted.
A satisfied customer.
HP dataprotector was also on bugtraq a few weeks back with the software containing a "hardcoded" password... HP is security fail!
Maybe you've forgotten, but the NSA/CIA/FBI has been pushing for CALEA II which is *exactly* this. Backdoors into everything.
Since HP is a major vendor to the NSA I can well believe they put it in with prompting from the NSA (maybe one of these super-secret warrants from the kangaroo court). But if they did you'd expect to see similar back doors in their other storage products.... erm like this one for example:
http://www.securityweek.com/backdoor-vulnerability-discovered-hp-msa2000-storage-systems
Yep, seems to be an ongoing theme with HP, backdoor passwords onto their storage products.
It slows the hack of the password, there is still a backdoor the NSA can access.