HP admits to backdoors in storage products
Usernames and passwords in the wild, factory resets possible — Hewlett-Packard has agreed that there is an undocumented administrative account in its StoreVirtual products, and is promising a patch by 17 July.
Context & Ripple Effects
In March 2013, HP's senior vice president of enterprise security software was arguing in public that the industry could learn from cyber criminals' methods — a posture that cast HP as a security thought leader. On 11 July that framing collided with the company's own product line: HP confirmed an undocumented administrative account in its StoreVirtual storage products, with the associated usernames and passwords already circulating publicly.
The admission travelled fast through the trade press — ZDNet carried the same story twice on the day — and HP committed to a patch by 17 July, leaving roughly a week in which unpatched StoreVirtual deployments are exposed to anyone holding the leaked credentials.
First-order effects
- StoreVirtual operators must treat every unpatched array as compromised territory: with valid admin credentials in the wild and factory resets possible, the only safe state is the patched one HP promises for 17 July.
- HP's enterprise storage team faces immediate trust damage on a flagship virtualization line, answering customer questions about how an undocumented account shipped in the first place.
Second-order effects
- Enterprise procurement teams buying storage will start writing hard-coded and undocumented account questions into vendor assessments, forcing rival storage makers to document their own administrative-access paths before researchers do it for them.
- Security researchers gain a proven target class — hidden factory-reset-capable accounts in storage firmware — and can be expected to probe competing arrays for the same pattern.
Third-order effects
- If hidden administrative accounts keep surfacing across hardware vendors, the structural outcome is pressure for third-party audit of embedded management software and explicit disclosure obligations rather than quiet vendor fixes.
- Vendors' internal calculus shifts: undocumented support access saves engineering cost but increasingly carries disclosure, patch-cadence, and reputational risk that outweighs the convenience.
The trend: Embedded device management is moving from silently shipped vendor backdoors toward disclosed, auditable administrative access, driven by researchers and enterprise buyers who punish discovery more than disclosure.