4 ms·

This is actually really much lower than I expected.. Though what helps is that most servers have a dedicated iLO interface and you really have to choose to con

This is actually really much lower than I expected.. Though what helps is that most servers have a dedicated iLO interface and you really have to choose to configure it on the regular ones along with normal traffic. So out of band is default. So in this case it's only people who have deliberately configured this. I think this is why it's not hundreds of thousands.

madjam002 5y ago
I've only dabbled with iLO but even when operating on the same interface I'm not sure how this gets onto the internet? From what I remember you configure it with a static IP, so these people surely are configuring their iLO to listen on a publicly routable IP?
- GekkePrutser 5y ago
  Yeah if your server is DMZ they could have configured it with another ip in the same range.. I guess it's something like that. Some of them could also be intentional, in order to provide management capabilities. At least iLO has no default password (each server comes with a label with the password)
assttoasstmgr 5y ago
Not sure I agree with you 100% on your police work there, Lou. I worked with a good number of SuperMicro servers that - to my surprise - the IPMI interface was by default set to "fail over to bridge to primary interface". That is to say if the IPMI port was disconnected, it would bridge onto your primary NIC with a second MAC address. The way to disable it was to download an obscure utility from SuperMicro's website, which only ran under Windows, and to pass an equally obscure hexadecimal command line flag. Fortunately in my case, these ran on a network with no DHCP server, but I can't assume that's true in every case.
- throwawayboise 5y ago
  Yes SuperMicro machines are configured that way. Some don't even have a dedicated separate IPMI interface.
  - dnautics 5y ago
    Yeah those supermicros scared the bejeezus out of me when I saw them in the catalog. I mean, yeah, you can configure the switch to listen onto different vlan ids, but what if something weird happens and that stateful information is lost or corrupted?
    - IYasha 5y ago
      Yeah, that's why I never put WAN on a shared interface. HP DOES THIS TOO. At least, they did. For example, on some g6 servers iLO/LO100 physical interface was optional (a small but costly add-on card) and, when not installed, iLO was shared with normal eth. If someone manages to hack a server enough to reset the shared iLO, at least it shouldn't immediately pop up into internet.
- GekkePrutser 5y ago
  iLO as the remote management tech from HP doesn't do that though, at least not on any of the servers I've seen. IPMI is a very different thing.
- jwiz 5y ago
  You can use ipmiutil with smcoem commands nowadays.
- deleted 5y ago
  [deleted]
wongarsu 5y ago
We once (~2 years ago) had an Asus server with their BMC, which is much easier to expose: while it has a dedicated physical interface by default it is also exposed on the first LAN port and configured to use DHCP. I can easily see how those boards leave you accidentally exposed in a colocation setup. But I'm still struggling to come up with a way to accidentally expose that on the internet. Public IPv4 isn't usually handed out via DHCP. My best guess is that the vast majority of these 20k servers have their management interface deliberately exposed. Only takes 2000 people with 10 servers each to think this is a good idea.
- wahern 5y ago
  > But I'm still struggling to come up with a way to accidentally expose that on the internet. See, e.g., https://www.armis.com/research/nat-slipstreaming-v20/ https://www.armis.com/research/nat-slipstreaming-v20/ and https://samy.pl/slipstream/ https://samy.pl/slipstream/
trebligdivad 5y ago
Note that the search was only for HP iLO's; not everyone elses model.
- GekkePrutser 5y ago
  Yeah I got that. Other brands don't actually have iLO as it's an HP trademark.
uf00lme 5y ago
The author filter down to a list of known types by checking favicon hashes, but I wonder how many are fake/honeypots?

madjam002 5y ago

I've only dabbled with iLO but even when operating on the same interface I'm not sure how this gets onto the internet? From what I remember you configure it with a static IP, so these people surely are configuring their iLO to listen on a publicly routable IP?

GekkePrutser 5y ago
Yeah if your server is DMZ they could have configured it with another ip in the same range.. I guess it's something like that. Some of them could also be intentional, in order to provide management capabilities. At least iLO has no default password (each server comes with a label with the password)

assttoasstmgr 5y ago

Not sure I agree with you 100% on your police work there, Lou. I worked with a good number of SuperMicro servers that - to my surprise - the IPMI interface was by default set to "fail over to bridge to primary interface". That is to say if the IPMI port was disconnected, it would bridge onto your primary NIC with a second MAC address. The way to disable it was to download an obscure utility from SuperMicro's website, which only ran under Windows, and to pass an equally obscure hexadecimal command line flag. Fortunately in my case, these ran on a network with no DHCP server, but I can't assume that's true in every case.

throwawayboise 5y ago
Yes SuperMicro machines are configured that way. Some don't even have a dedicated separate IPMI interface.
- dnautics 5y ago
  Yeah those supermicros scared the bejeezus out of me when I saw them in the catalog. I mean, yeah, you can configure the switch to listen onto different vlan ids, but what if something weird happens and that stateful information is lost or corrupted?
  - IYasha 5y ago
    Yeah, that's why I never put WAN on a shared interface. HP DOES THIS TOO. At least, they did. For example, on some g6 servers iLO/LO100 physical interface was optional (a small but costly add-on card) and, when not installed, iLO was shared with normal eth. If someone manages to hack a server enough to reset the shared iLO, at least it shouldn't immediately pop up into internet.
GekkePrutser 5y ago
iLO as the remote management tech from HP doesn't do that though, at least not on any of the servers I've seen. IPMI is a very different thing.
jwiz 5y ago
You can use ipmiutil with smcoem commands nowadays.
deleted 5y ago
[deleted]

wongarsu 5y ago

We once (~2 years ago) had an Asus server with their BMC, which is much easier to expose: while it has a dedicated physical interface by default it is also exposed on the first LAN port and configured to use DHCP. I can easily see how those boards leave you accidentally exposed in a colocation setup. But I'm still struggling to come up with a way to accidentally expose that on the internet. Public IPv4 isn't usually handed out via DHCP. My best guess is that the vast majority of these 20k servers have their management interface deliberately exposed. Only takes 2000 people with 10 servers each to think this is a good idea.

wahern 5y ago
> But I'm still struggling to come up with a way to accidentally expose that on the internet. See, e.g., https://www.armis.com/research/nat-slipstreaming-v20/ https://www.armis.com/research/nat-slipstreaming-v20/ and https://samy.pl/slipstream/ https://samy.pl/slipstream/

trebligdivad 5y ago

Note that the search was only for HP iLO's; not everyone elses model.

GekkePrutser 5y ago
Yeah I got that. Other brands don't actually have iLO as it's an HP trademark.

uf00lme 5y ago

The author filter down to a list of known types by checking favicon hashes, but I wonder how many are fake/honeypots?