4 ms·
Title is highly misleading. Outright dishonest. Their argument is essentially: If you can remove and repogram a network connected micro-controller (specificall
by Someone1234 8y ago
Title is highly misleading. Outright dishonest.
Their argument is essentially: If you can remove and repogram a network connected micro-controller (specifically the BMC) you can introduce a backdoor.
Which is both obvious, and has absolutely nothing to do with Bloomberg's claims.
I'd strongly recommend the mods change both the link and title to the original eclypsium source:
"The Missing Security Primer for Bare Metal Cloud Services"
https://eclypsium.com/2019/01/26/the-missing-security-primer-for-bare-metal-cloud-services/ https://eclypsium.com/2019/01/26/the-missing-security-primer...
- ams6110 8y agoYou don't need to remove the microcontroller. You can reflash it using a utility, and the researchers showed that IBM was not resetting the BMC firmware between clients on that bare-metal server.
- egwynn 8y agoCorrect. The recent news is that companies who lease bare-metal often don’t do a good job cleaning up after previous tenants’ BMC modifications. Currently this is happening at least with an IBM platform where they’re leasing Supermicro hosts. It could just as easily be happening with another hosting provider leasing another company’s hardware.