3 ms·

I think we're talking about two different things. BMCs run separately from the rest of the system and are active even when the machine is halted. They provide r

by Tiksi 10y ago

I think we're talking about two different things. BMCs run separately from the rest of the system and are active even when the machine is halted. They provide remote mouse/keyboard/monitor, power control, remote device mounting, bios settings, hardware sensors and monitoring, etc. These have been in servers for ages, do the same thing as IME, and are way less secure. None of it has any relevance to software updaters or software at all really since a lot of these boxes are shipped without an OS or even hard drives.

dlmetcalf 10y ago
I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slightly more options (if slim). Agree it's not widely enough recognised either though. There's some coverage at least: https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22off%22/13399 https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+... http://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/ http://arstechnica.com/security/2013/08/remote-admin-tool-im... https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf https://www.usenix.org/system/files/conference/woot13/woot13... https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi https://community.rapid7.com/community/metasploit/blog/2013/... https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... http://www.websecuritywatch.com/authentication-bypass-vulnerability-in-ipmi-2-0-rakp-through-the-use-of-cipher-zero/ http://www.websecuritywatch.com/authentication-bypass-vulner... http://fish2.com/ipmi/itrain.pdf http://fish2.com/ipmi/itrain.pdf

by Tiksi 10y ago

dlmetcalf 10y ago

I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slightly more options (if slim). Agree it's not widely enough recognised either though. There's some coverage at least: https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+turned+%22off%22/13399 https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+... http://arstechnica.com/security/2013/08/remote-admin-tool-imperils-servers/ http://arstechnica.com/security/2013/08/remote-admin-tool-im... https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf https://www.usenix.org/system/files/conference/woot13/woot13... https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi https://community.rapid7.com/community/metasploit/blog/2013/... https://www.schneier.com/blog/archives/2013/01/the_eavesdroppi.html https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... http://www.websecuritywatch.com/authentication-bypass-vulnerability-in-ipmi-2-0-rakp-through-the-use-of-cipher-zero/ http://www.websecuritywatch.com/authentication-bypass-vulner... http://fish2.com/ipmi/itrain.pdf http://fish2.com/ipmi/itrain.pdf