{"id":920,"date":"2020-10-08T11:00:16","date_gmt":"2020-10-08T15:00:16","guid":{"rendered":"https:\/\/www.pwvconsultants.com\/blog\/?p=920"},"modified":"2020-10-08T11:00:18","modified_gmt":"2020-10-08T15:00:18","slug":"beware-hp-device-manager-has-backdoor","status":"publish","type":"post","link":"https:\/\/www.pwvconsultants.com\/blog\/beware-hp-device-manager-has-backdoor\/","title":{"rendered":"Beware: HP Device Manager Has Backdoor"},"content":{"rendered":"\n

The backdoor can gain unauthorized access to remote command execution and be exploited to achieve privilege. Businesses should follow mitigation processes provided by HP.<\/h2>\n\n\n\n

There has been an uptick in cyber-attacks and data breaches in 2020. While this increases each year, this year feels especially hard hit, likely due to the COVID-19 pandemic. With everyone working from home, businesses are strained and systems are breaking down, making them easier to exploit. On top of that, now businesses that use HP Device Manager have to take action to mitigate a vulnerability that was put there by HP itself.<\/p>\n\n\n\n

According to The Register<\/a>, \u201cNicky Bloor, founder of Cognitous Cyber Security, reports that an HP Inc programmer appears to have set up an insecure user account in a database within HP Device Manager<\/a> (HPDM). He found that the account can be exploited to achieve privilege escalation and, in conjunction with other flaws, gain unauthorized remote command execution as SYSTEM.<\/p>\n\n\n\n

This is bad: if you can reach a vulnerable installation of this device manager on a network, you can gain admin-level control over its machine and the thin clients it controls. HPDM typically runs on a Windows-powered server, and directs multiple Windows clients.\u201d<\/p>\n\n\n\n

This is a nightmare for businesses that use HPDM, and it\u2019s a dream for an attacker. Bad actors, like any other criminal, want to get the most bang for their buck. They don\u2019t want to exert a lot of energy, but they want a big payday. If a bad actor gains admin-level control over one machine, they can use that access to gain entry to other machines. They can practically do whatever it is they want to do and they haven\u2019t broken a sweat.<\/p>\n\n\n\n

Cyber Observer<\/a> says the 8 most common causes of a data breach are:<\/p>\n\n\n\n