GoKawiilFacepalm: Attackers are targeting hardware that keeps modern servers running, with the weak point being the baseboard management controller (BMC) installed on the motherboard. New research shows that thousands of these controllers, shipped for years by major server manufacturers, remain exposed on the Internet and within corporate networks due to serious, long-standing flaws that are still easy to exploit.
Baseboard management controllers, or BMCs, are small computers built into nearly every enterprise server. They have their own firmware, operating system, network stack, and IP address. Administrators use them to reboot machines, install updates, reinstall operating systems, and monitor hardware, even when the main server is powered off or unresponsive.
That deep level of control makes BMCs valuable for IT operations but dangerous if attackers gain access. If compromised, a BMC can give an attacker control over the underlying server.
At the Black Hat security conference in Las Vegas, firmware security expert HD Moore, CEO and founder of runZero, presented new research showing that many of the weaknesses he identified back in 2013 are still present. He also revealed more than a dozen newly discovered vulnerabilities affecting BMCs from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and other vendors.
The core problem continues to center around IPMI, the protocol that allows BMCs to manage servers out of band.
"The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize," Moore wrote in an email ahead of his talk.
To measure the scale of the exposure, Moore conducted two broad scans. One looked for BMCs accessible over the public Internet, while the other searched internal corporate networks.
The external scan found more than 86,000 BMCs with management services exposed to the public Internet. More than half of them (54%) had at least one critical vulnerability. As many as 75,000 remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows attackers to crack administrator passwords offline. Inside corporate networks, an internal scan of 126,761 BMCs found that nearly 29% contained one or more critical vulnerabilities.
The vulnerabilities Moore described affect multiple layers of the BMC stack. Some involve IPMI authentication, while others affect session security, memory management, and the handling of firmware and secrets.
One category of vulnerabilities stems from flaws in the IPMI authentication handshake. Attackers can manipulate the order of messages to bypass checks and gain a limited foothold in the BMC.
... continue reading