4 ms·
Hidden admin user on every HP MSA2000 G3
- ra 16y agoIf this is for real then it's flabbergasting.
- stewsnooze 16y agoIs this hacker news or hacker leaks? everybody run.....
- evgeny0 16y agoI can just see it now... - A hidden admin account is perfect for debugging and support! - What if someone guesses the password? - Nah, who the hell is gonna guess THAT?!
- nkassis 16y agothe exclamation at the beginning would throw off most script kiddies seriously. Who puts an exclamation point at the beginning?
- iuguy 16y agoSomeone who's really, really excited about their new admin account.
- lallysingh 16y agoIt's to fight robots. I am admin. I am !admin.
- wakeup 16y agowhat the fuck. lol. This supports my theory that most humans are knuckleheads.
- spuz 16y agoDoes anyone know what a HP MSA2000 G3 is? Google vaguely hints that it could be a laptop.
- jey 16y agoGoogling it suggests that it's a SAN (Storage Area Network) device. Which is like an industrial-scale hard disk system. http://h71016.www7.hp.com/dstore/ctoBases.asp?ProductLineId=450&FamilyId=2569&LowBaseId=15222&LowPrice= http://h71016.www7.hp.com/dstore/ctoBases.asp?ProductLineId=...
- deleted 16y ago[deleted]
- crocowhile 16y agoA laptop?! This is the first result on google: http://h10010.www1.hp.com/wwpc/us/en/sm/WF04a/12169-304616-241493-241493-241493.html http://h10010.www1.hp.com/wwpc/us/en/sm/WF04a/12169-304616-2...
- werrett 16y agoThink of it as just a big disk enclosure. You can either plug it into the back of an HP server or plonk it on the network by itself. Google has some good pictures: http://www.google.com/images?q=HP%20MSA%203000 http://www.google.com/images?q=HP%20MSA%203000 HP's high-end 'ProLiant' kit have "Integrated Lights-out" that will allow you to do things like power cycle the device, drop on to the serial console, etc. All over a user friendly web interface. I'm assuming this 'admin backdoor' it is for that.
- zsouthboy 16y agoIt's a SAN device with a ton of drive bays. We've got a few and they seem pretty speedy, haven't had an issue with them. I'm already investigating what generation we have - but I'm almost certain our initial setup on at least one was using the admin !admin credentials, which means that it's documented _somewhere_.
- patrickgzill 16y agoPretty serious, considering that these devices can do iSCSI - meaning any machine with access to it over the LAN, such as any machine that is getting some iSCSI storage from the device, can now do nefarious things.
- zsouthboy 16y agoI don't know about others, but we put all our iSCSI stuff on a physically disparate network, separate NICs, separate switches. Doesn't help if someone has physical access to the datacenter, but that's a given.
- patrickgzill 16y agoWould it not be the case, that a compromised machine that was mounting iSCSI, might then be able to access the hidden admin feature? It could then mount other volumes read-only and read data meant to be private...
- thehigherlife 16y agoNot necessarily. In most cases administration access to these things are on an entirely separate network from connection protocol. Having an iSCSI / nfs connection isn't enough; you'd also have to be on the same network as the management interface.
- iwwr 16y agoFreeNAS solves all these hidden vendor problems.
- somabc 16y agoHas anyone confirmed this in the wild?
- jbarber 16y agoIt works on one I have, the interesting thing will be see if it works on other recent MSA arrays as well.
- privacyguru 16y agoWe added little more info here -- http://www.securityweek.com/backdoor-vulnerability-discovered-hp-msa2000-storage-systems http://www.securityweek.com/backdoor-vulnerability-discovere...
- jkahn 16y agoFor those that don't know, an HP MSA2000 is a baby SAN - a small business storage array. There's not a lot of info in that post, and I don't see any other posts in the thread. This is an issue if it can be accessed remotely, but not a big deal if it requires a console cable. Even if it CAN be accessed remotely, it shouldn't be as big an issue as you'd think. SANs are usually not connected to the Internet and the management ports should be set on separate management VLANs. The number of SAN installs I've seen where the SAN engineer installing it left the passwords at the default and the customer never changed them is mind-boggling, anyway. Not to take away from the importance of something like this, but it's not as severe as say, a remote-root exploit in Linux.