> it is also very easy to detect it. Not necessarily! At least on some hardware it would be pretty easy for the BMC to cause targeted packet-loss (e.g. by re

> it is also very easy to detect it. Not necessarily! At least on some hardware it would be pretty easy for the BMC to cause targeted packet-loss (e.g. by replacing microcode on network controllers). So if I were a state level attacker, I would get data out by causing a tiny amount (1%) of packet loss based on a secret key-stream and the data I wanted to exfiltrate. (I'd use the sequence numbers to index into a rateless error correcting code or similar.) Then I just need to be able to surveil a host you're communicating with for long enough to recover the data. This also strong privacy for the destination of the attack if the attack is ever discovered. If you're just trying to exfiltrate secret keys or the results of complex queries (as the attacker->victim channel can be high bandwidth without being too suspect) then it could be exceptionally difficult to detect this.