26 ms·

I reported a security issue in Supermicro's IPMI implementation to them. They dismissed the issue and never fixed it. These companies don't care if there's no

I reported a security issue in Supermicro's IPMI implementation to them. They dismissed the issue and never fixed it. These companies don't care if there's no way to stop a remote control service (iLo, iDRAC, IPMI) from binding to a motherboard ethernet port. In the case of Supermicro, you can't configure via the built-in BIOS, there are no jumpers you can use, and you must have a full network setup and installed tools to configure a new machine. This makes deploying in the field much, much more problematic. If the BIOS battery dies and settings set are lost, the motherboard defaults to joining whichever ethernet is active, with default credentials. It's incredibly stupid and insecure. I will never buy Supermicro again, but for the hardware that was already bought, I mandated loopback plugs for all IPMI ports so the IPMI wouldn't switch to the system ethernet.

zamadatix 5y ago
Supermicro switched to unique default passwords (same as Dell/HPE) a few years back. Silly to not have day one but really when you look at any of these they are all a security nightmare.
- op00to 5y ago
  Dell’s not root/Calvin anymore?
  - zamadatix 5y ago
    For most probably as you have to know to order it specifically with secure password unlike HPE/Supermicro which just do it every time now. Likely they got hit with a government/large customer requirement and half assed it, as most things BMC are.
  - donflamenco 5y ago
    It hasn't been for years now. The systems get a unique password from the factory and is on the tag.
stingraycharles 5y ago
Honest question: do people actually connect their ipmi / bmc to the public internet? Or is it something different that’s being exposed here?
- jwiz 5y ago
  Sometimes the interface will piggyback on the same physical port as the primary NIC, so you can accidentally get it on the network without knowing. Supermicros default to using the dedicated nic for IPMI, but they also default to using the piggyback if there is no link on the dedicated nic. :(
  - mise_en_place 5y ago
    Huh, I thought they listen on an invalid IP address by default for security reasons.
  - iso1210 5y ago
    Which means everything is fine, then the ipmi switch port is shut down, and suddenly you're exposed in an unexpected fashion. It's not good. At least the password is no longer ADMIN/ADMIN on new kit, although I had one supermicro machine connected for me in India last week which was old enough that it was ADMIN/ADMIN
- achillean 5y ago
  Yes, they do. For example: https://threatpost.com/plaintext-supermicro-ipmi-credentials-exposed/106784/ https://threatpost.com/plaintext-supermicro-ipmi-credentials... Here's a search for some of them (requires a Shodan account): https://www.shodan.io/search?query=ssl%3Aipmi https://www.shodan.io/search?query=ssl%3Aipmi
  - MikeAshley178 5y ago
    For those who don't have a Shodan Subscription you can use Open Datasets to find the same...and more https://github.com/tg12/rapid7_OSINT https://github.com/tg12/rapid7_OSINT

zamadatix 5y ago

Supermicro switched to unique default passwords (same as Dell/HPE) a few years back. Silly to not have day one but really when you look at any of these they are all a security nightmare.

op00to 5y ago
Dell’s not root/Calvin anymore?
- zamadatix 5y ago
  For most probably as you have to know to order it specifically with secure password unlike HPE/Supermicro which just do it every time now. Likely they got hit with a government/large customer requirement and half assed it, as most things BMC are.
- donflamenco 5y ago
  It hasn't been for years now. The systems get a unique password from the factory and is on the tag.

stingraycharles 5y ago

Honest question: do people actually connect their ipmi / bmc to the public internet? Or is it something different that’s being exposed here?

jwiz 5y ago
Sometimes the interface will piggyback on the same physical port as the primary NIC, so you can accidentally get it on the network without knowing. Supermicros default to using the dedicated nic for IPMI, but they also default to using the piggyback if there is no link on the dedicated nic. :(
- mise_en_place 5y ago
  Huh, I thought they listen on an invalid IP address by default for security reasons.
- iso1210 5y ago
  Which means everything is fine, then the ipmi switch port is shut down, and suddenly you're exposed in an unexpected fashion. It's not good. At least the password is no longer ADMIN/ADMIN on new kit, although I had one supermicro machine connected for me in India last week which was old enough that it was ADMIN/ADMIN
achillean 5y ago
Yes, they do. For example: https://threatpost.com/plaintext-supermicro-ipmi-credentials-exposed/106784/ https://threatpost.com/plaintext-supermicro-ipmi-credentials... Here's a search for some of them (requires a Shodan account): https://www.shodan.io/search?query=ssl%3Aipmi https://www.shodan.io/search?query=ssl%3Aipmi
- MikeAshley178 5y ago
  For those who don't have a Shodan Subscription you can use Open Datasets to find the same...and more https://github.com/tg12/rapid7_OSINT https://github.com/tg12/rapid7_OSINT