4 ms·

Unfortunately I have to concur with GP, my experience in penetration testing is that many sysadmins seem oblivious to the existence of ILO systems, or don't bel

Unfortunately I have to concur with GP, my experience in penetration testing is that many sysadmins seem oblivious to the existence of ILO systems, or don't believe they can cause any harm. Alternatively, sometimes one simply slips through the cracks, and all it takes is one system with cached credentials to wreck havoc to a network. Ironically, the more expensive ILO systems can be easier to exploit. Just throw a Linux live rescue image onto virtual media, reboot the machine, and you can grab everything sensitive fairly quickly.

xoa 5y ago
Well (and to sibling comment), TIL, thank you :(. That's scary though, that anyone could even use the BMC and not at least pause a bit on "wait a sec, what could someone else do with this", same as hypervisor access. Though maybe some of the blame really should be on the vendors themselves here. At least credentials are randomized now, but they could be much more aggressive about making it something that has to be actively turned on, always has it's own physically isolated port, and requires some level of secure setup (won't communicate untagged maybe?). Or these days making hardware token/smartcard usage required perhaps. There's clearly tradeoffs to be made in terms of security vs convenience/recovery from bad setups, and the balance has fallen fairly decisively in favor of the latter. Kind of depressing though the industry constantly has to do the same thing of ignoring security right up until it gets really, really bad.
- ILMostro7 5y ago
  In their view, they place a great deal of importance on security; at least for marketing purposes. Sustaining a secure system after it's sold and work has begun on marketing the next new supersecure thing... that's a different story
laumars 5y ago
That’s been my experience as well

4 ms·

Unfortunately I have to concur with GP, my experience in penetration testing is that many sysadmins seem oblivious to the existence of ILO systems, or don't bel

by spijdar 5y ago

xoa 5y ago
Well (and to sibling comment), TIL, thank you :(. That's scary though, that anyone could even use the BMC and not at least pause a bit on "wait a sec, what could someone else do with this", same as hypervisor access. Though maybe some of the blame really should be on the vendors themselves here. At least credentials are randomized now, but they could be much more aggressive about making it something that has to be actively turned on, always has it's own physically isolated port, and requires some level of secure setup (won't communicate untagged maybe?). Or these days making hardware token/smartcard usage required perhaps. There's clearly tradeoffs to be made in terms of security vs convenience/recovery from bad setups, and the balance has fallen fairly decisively in favor of the latter. Kind of depressing though the industry constantly has to do the same thing of ignoring security right up until it gets really, really bad.
- ILMostro7 5y ago
  In their view, they place a great deal of importance on security; at least for marketing purposes. Sustaining a secure system after it's sold and work has begun on marketing the next new supersecure thing... that's a different story
laumars 5y ago
That’s been my experience as well