5 ms·

Remote office management can be handled by a KVM with remote access. These can be security hazards in their own right, but it’s a lot safer than having some ven

by romed 8y ago

Remote office management can be handled by a KVM with remote access. These can be security hazards in their own right, but it’s a lot safer than having some vendor junk literally hard-wired to your PCI bus.

acdha 8y ago
Now you have a second device to buy, secure and support, and it can't do everything that an ILOM can (most importantly, remote power management). Having had security updates for KVMs, I'm also not sure your assumption that it's safer is true in any meaningful sense. Management engine vulnerabilities have gotten a lot of hype over the last year or two but most of it has been marketing for security companies rather than a serious risk (e.g. what percentage of bugs required local network access, which should not be easy to get on your management VLAN). During a similar period, we've also had Spectre/Meltdown and the usual slew of software vulnerabilities so I have trouble with the conclusion that the answer is to stop using a useful tool rather than continuing the industry-wide effort to improve the level of security competency among development teams.
- romed 8y ago
  For many BMCs the second network port is a figment of your imagination. The BMC is capable of intercepting and injecting network frames on the host's interfaces. Just because you have the management port wired to a different VLAN or even a separate physical LAN means nothing.
  - dboreham 8y ago
    BMC NIC is generally capable of being bridged to one of the main NICs, although it is possible to disable that feature, but also possible to override the disabling if you control the hardware.
  - acdha 8y ago
    It's true that many BMCs use the same physical network interface but that doesn't help an attacker hit it with a remote exploit. It could be relevant in the question of what could be done after compromise but for preventing that initial attack it's pretty effective.
dboreham 8y ago
Last time I looked all the SM motherboards could be ordered sans BMN (saves $50 or so). Parts with -F have the BMC. So you'd think Apple, Amazon et al would order the BMC-less SKU.

by romed 8y ago

acdha 8y ago

Now you have a second device to buy, secure and support, and it can't do everything that an ILOM can (most importantly, remote power management). Having had security updates for KVMs, I'm also not sure your assumption that it's safer is true in any meaningful sense. Management engine vulnerabilities have gotten a lot of hype over the last year or two but most of it has been marketing for security companies rather than a serious risk (e.g. what percentage of bugs required local network access, which should not be easy to get on your management VLAN). During a similar period, we've also had Spectre/Meltdown and the usual slew of software vulnerabilities so I have trouble with the conclusion that the answer is to stop using a useful tool rather than continuing the industry-wide effort to improve the level of security competency among development teams.

romed 8y ago
For many BMCs the second network port is a figment of your imagination. The BMC is capable of intercepting and injecting network frames on the host's interfaces. Just because you have the management port wired to a different VLAN or even a separate physical LAN means nothing.
- dboreham 8y ago
  BMC NIC is generally capable of being bridged to one of the main NICs, although it is possible to disable that feature, but also possible to override the disabling if you control the hardware.
- acdha 8y ago
  It's true that many BMCs use the same physical network interface but that doesn't help an attacker hit it with a remote exploit. It could be relevant in the question of what could be done after compromise but for preventing that initial attack it's pretty effective.

dboreham 8y ago

Last time I looked all the SM motherboards could be ordered sans BMN (saves $50 or so). Parts with -F have the BMC. So you'd think Apple, Amazon et al would order the BMC-less SKU.