3 ms·
Or just reflash the firmware. They should, but most people don't reflash the bios and BMC firmware when they install a new server. In fact I routinely encounter
by ams6110 8y ago
Or just reflash the firmware. They should, but most people don't reflash the bios and BMC firmware when they install a new server. In fact I routinely encounter servers that are 5+ years in service that have never been reflashed.
- dboreham 8y agootoh you have to consider the probability that flashing the firmware will brick your server (p >> 0.0 in my experience).
- ams6110 8y agoAbsolutely, and I think that is why a lot of people are reluctant to do it. It's a fragile process and if you lose power or have a random cosmic ray hit at the wrong time it's game over.
- mjg59 8y agoI know more than one vendor who's dumped firmware from BMCs to compare to the vendor image. Simply reflashing the firmware would be caught by this, an implant wouldn't.
- basseq 8y agoApple, at least, claims they do[1]: "As a matter of practice, before servers are put into production at Apple they are inspected for security vulnerabilities and we update all firmware and software with the latest protections." [1] https://www.apple.com/au/newsroom/2018/10/what-businessweek-got-wrong-about-apple/ https://www.apple.com/au/newsroom/2018/10/what-businessweek-...
- ofrzeta 8y agoThey surely don't write their own firmware for Supermicro boards? So "update firmware .. with the latest protections" means update from the hardware vendor?
- cmurf 8y agoThere's quite a lot of embedded firmware that isn't derived or controlled or affected by BIOS/UEFI firmware updates. e.g. Thunderbolt (PCIe) firmware.