4 ms·
It depends. These chips were specifically connected to the BMC/IPMI: >The illicit chips could do all this because they were connected to the baseboard manageme
by parliament32 8y ago
It depends. These chips were specifically connected to the BMC/IPMI:
>The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off.
Is your OOB-management VLAN/network firewalled off from outgoing access to the internet? If not, this chip can make requests out to another host, who gives it code to run. This code can then either collect data and send it back out, or do other nefarious things.
- bubblethink 8y agoThe BMC is always on a maintenance vlan for any organization worth its salt. The software stack on those things doesn't deserve to see the light of the day. If you open it up to the internet, you will get pwned, china or not. So there seems to be something missing. It can't just be a compromised BMC. Edit: Now that I think of it, a compromised BMC can inject payloads into the running OS, depending on the sophistication of the attack and the defenses of the OS. So it does seem possible.
- parliament32 8y agoKeep in mind that the BCM already has the ability to piggyback on the production interface if it decides the dedicated interface isn't connected to anything... what's to stop it from doing this in a mailicious scenario and fire off some garbage-looking dns/icmp/whatever?
- jeletonskelly 8y agoUnless you're air-gapped you can usually assume that if the machines are syncing to public NTP then there's a way in and out.
- pixl97 8y agoHow many organizations actually watch what is coming in and out of their DNS?
- bb611 8y agoI work for a company a couple orders of magnitude smaller than Apple/Amazon and we do. If you're in a production environment we're watching every network request, and there's no public access we don't want.
- JdeBP 8y agoMore anecdotes like this can be found at https://news.ycombinator.com/item?id=18138484 https://news.ycombinator.com/item?id=18138484 .
- astrange 8y agoDo people really set all their servers to point to someone else's NTP?