4 ms·
It sometimes feels like certain hardware protocols were designed to be insecure. I remember reading about IPMI issues back in 2013: https://www.itworld.com/ar
by Cieplak 8y ago
It sometimes feels like certain hardware protocols were designed to be insecure. I remember reading about IPMI issues back in 2013:
https://www.itworld.com/article/2708437/security/ipmi--the-most-dangerous-protocol-you-ve-never-heard-of.html https://www.itworld.com/article/2708437/security/ipmi--the-m...
- RL_Quine 8y agoSuperMicro hardware in particular always struck me as such. Asking users to pay a license fee to be able to update the BIOS on their devices (after paying tens of thousands for the hardware itself) is a kick in the teeth. https://www.virtuallifestyle.nl/wp-content/uploads/2016/08/SMBU.png https://www.virtuallifestyle.nl/wp-content/uploads/2016/08/S... http://www.supermicro.com/products/nfo/SMS_SUM.cfm http://www.supermicro.com/products/nfo/SMS_SUM.cfm
- detaro 8y agoTo be clear, this is only for the ability to update the BIOS over the BMC interface, not for BIOS updates in general. (unlike some other vendors, where you need a support contract to be even able to download the updates) At least on some boards you can boot the USB drive image containing the BIOS updater through the BMC and do a remote update that way.
- RL_Quine 8y agoFor the models I was looking at a number of years ago, the options were through IPMI or via a USB Floppy Drive. Perhaps my memory is failing me here, but I seem to remember being quite enraged at the prospect and would have done a lot not to have to pay the license fee on principle.
- bubblethink 8y agoSupermicro doesn't publish changelogs for their BIOSes. Their disclaimer on their BIOS download page says, "don't update the BIOS unless you have to". It's a ridiculous stance for a server company. You buy Supermicro over Dell for the price. That's pretty much it.
- shaklee3 8y agoPrice, variation, and time to market.
- majewsky 8y ago"Designed to be insecure" is probably unfair to the designers of IPMI. Security was just not as big a concern as it is today.
- pjc50 8y agoThis is only really valid for protocols or products designed before the Morris worm of 1988. Anything designed beyond 2000 has no excuse for not thinking about internet security.
- vel0city 8y agoWell, IPMI isn't supposed to be exposed to the internet. Best practices have you running your BMC's on a completely separate, highly locked down administrative network.
- parliament32 8y agoWell yes, typically you'd 1) configure IPMI to use the dedicated port, 2) put those ports into a VLAN with no outgoing internet access. But since this is BMC, what's stopping it from just using your management or production port to fire off its secret phone-homes and whatnot?
- greglindahl 8y agoBest practice would be for the BMC to not have access to the regular network ports when it has a dedicated network jack. All the ones I've looked at don't have any kind of physical interlock or switch, it's a software interlock. Now even a hardware interlock could be subverted, but that's harder than sticking code in the bmc firmware, which does tend to get updated during the life of a server.
- dsl 8y agoI did a security audit on a company that had a setup similar to this. After popping an internet facing web server, I was able to compromise the IPMI system and use the management network to bounce around to any server in the enterprise completely bypassing all the firewalls and segmentation on the production network. Management networks need rack level isolation.