HP (Hewlett Packard) has admitted that its StoreVirtual storage area network (SAN) products contain a ‘backdoor’ that allows remote access via an administrative account.
This essentially means that anyone with an account username and password meant for backdoor access will be able to log into the systems and gain access to the operating system, which is a big security hole. These backdoors are actually meant for providing remote support to customers and replaced a hard-rest button which used to be present on the hardware to factory reset the systems. HP started including a different backdoor access account into LeftHand 9.0 the custom operating system used by HP’s network storage appliance.
HP has promised to deliver a fix by July 19, The Register notes.
The vulnerability was discovered by Technion, a blogger who first brought it to public notice and to HP’s notice through its forums and pointed out that these accounts have existed since 2009.
In a new communication bulletin, HP has admitted that its SAN devices have a vulnerability that could be remotely exploited to gain unauthorised access to the device. However, it has said that the backdoor entry does not offer access to the user data stored on the system.
Here’s the full text of the communication:
A potential security vulnerability has been identified with the HP StoreVirtual Storage. This vulnerability could be remotely exploited to gain unauthorized access to the device.
All HP StoreVirtual Storage systems are equipped with a mechanism that allows HP support to access the underlying operating system if permission and access is provided by the customer. This functionality cannot be disabled today.
HP has acknowledged this vulnerability and will provide a patch that will allow customers to disable the support access mechanism on or before July 17, 2013.
HP StoreVirtual products are storage appliances that use a custom operating system, LeftHand OS, which is not accessible to the end user. Limited access is available to the user via the HP StoreVirtual Command-Line Interface (CLiQ) however root access is blocked.
Root access may be requested by HP Support in some cases to help customers resolve complex support issues. To facilitate these cases, a challenge-response-based one-time password utility is employed by HP Support to gain root access to systems when the customer has granted permission and network access to the system. The one-time password utility protects the root access to prevent repeated access to the system with the same pass phrase. Root access to the LeftHand OS does not provide access to the user data being stored on the system.
