4 ms·
Misleading article title. (What better to expect from The Register?) HP admitted there's a vulnerabiity that with customer provided access and permission can al
by blinkingled 13y ago
Misleading article title. (What better to expect from The Register?) HP admitted there's a vulnerabiity that with customer provided access and permission can allow HP support to access underlying os of the storage device. At most a reboot is possible not data access. So this is just another stupid vulnerability that'll be fixed soon - not a backdoor.
- nness 13y agoI would say otherwise, seeing as that it was a known vulnerability, and left in intentionally. Very much a backdoor.
- ikurei 13y agoWhy "intentionally". May be it was put there intentionally but leaving it that way was a mistake. I don't think that's a backdoor, just from the article.
- venomsnake 13y agoI would say that both malice and stupidity of HP are well balanced in this case.
- ikurei 13y agoWhy "intentionally". May be it was put there intentionally but leaving it that way was a mistake. I don't think that's a backdoor, just from the article.
- ikurei 13y agoIt doesn't say it was left there intentionally. We don't have (or this article does not give) information enough to call it a backdoor.
- yen223 13y agoAccidentally leaving an open administrator account is a bug as old as time. I won't necessarily attribute it to malice. That said, it's still a backdoor, whether it was left there intentionally or not. I'd have a hard time trusting HP products after this.
- bigiain 13y ago" … with customer provided access and permission can allow HP support … " Which, cynically, could easily be read as "with the storage device on a network, and with a company policy requiring support staff to request permission before using it". Maybe these things aren't _intended_ to be directly internet connected - but there's a _lot_ of gear that ebds up that way without ever having been designed too. Even HP admit: "This vulnerability could be remotely exploited to gain unauthorized access to the device." And from the end of the article - it seems at most: "And, of course, there's the "reset factory defaults" option, which would nuke all a user's data." - still not a "backdoor", but somewhat worse than just "a reboot".
- kryten 13y agoHP are lying. The article title is correct. You can use many well known kernel vulnerabilities to get root on the box after logging in as hpsupport. At that point you can do block reads off anything you want.