4 ms·

Honest question: do people actually connect their ipmi / bmc to the public internet? Or is it something different that’s being exposed here?

jwiz 5y ago
Sometimes the interface will piggyback on the same physical port as the primary NIC, so you can accidentally get it on the network without knowing. Supermicros default to using the dedicated nic for IPMI, but they also default to using the piggyback if there is no link on the dedicated nic. :(
- mise_en_place 5y ago
  Huh, I thought they listen on an invalid IP address by default for security reasons.
- iso1210 5y ago
  Which means everything is fine, then the ipmi switch port is shut down, and suddenly you're exposed in an unexpected fashion. It's not good. At least the password is no longer ADMIN/ADMIN on new kit, although I had one supermicro machine connected for me in India last week which was old enough that it was ADMIN/ADMIN
achillean 5y ago
Yes, they do. For example: https://threatpost.com/plaintext-supermicro-ipmi-credentials-exposed/106784/ https://threatpost.com/plaintext-supermicro-ipmi-credentials... Here's a search for some of them (requires a Shodan account): https://www.shodan.io/search?query=ssl%3Aipmi https://www.shodan.io/search?query=ssl%3Aipmi
- MikeAshley178 5y ago
  For those who don't have a Shodan Subscription you can use Open Datasets to find the same...and more https://github.com/tg12/rapid7_OSINT https://github.com/tg12/rapid7_OSINT
TheSmiddy 5y ago
Extremely lazy MSPs will port forward ports to BMCs instead of using a VPN or SSH tunnel.
redprince 5y ago
I like to quote the Internet Census of 2012 [1] whenever that question comes up: "A lot of devices and services we have seen during our research should never be connected to the public Internet at all. As a rule of thumb, if you believe that "nobody would connect that to the Internet, really nobody", there are at least 1000 people who did. Whenever you think "that shouldn't be on the Internet but will probably be found a few times" it's there a few hundred thousand times. Like half a million printers, or a Million Webcams, or devices that have root as a root password." [1] http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html
- spicybright 5y ago
  Honestly an excellent rule of thumb.
- dylan604 5y ago
  > or a Million Webcams Um, like web is in the name. Othewise, good points
cm2187 5y ago
If you have a single server in colocation you may not have a choice. The only thing that allows me to sleep at night is that SM's IPMI has a firewall and you can whitelist a limited number of IPs.
iso1210 5y ago
They are often inline with eth0. Sometimes they have a dedicated ilo/ipmi/etc, but if that's not connected it sticks ilo on eth0. I once connected a server to a network and it wouldn't take the room's VGA KVM, so I started a dhcp server on my laptop to get onto the ipmi 63 leases were given out in a few seconds -- the lights-out (ilo, ipmi) that were on that network had never been configured, were just sat sending out dhcp requests and getting no response. The servers themselves were all statics, but nobody had bothered setting up the ilos. Most were of the age of a default password (ADMIN/ADMIN for supermicro for example) Now this is on a private network with internet via a proxy, so fairly bad, but not catastrophic. It shows how easy it is to connect something to the internet accidently though. Personally I put ilos on a dedicated vlan with an ACL blocking access to anywhere other than the management servers, it's not just incoming connections from the internet or from compromised machines behind your firewall, it's outgoing connections from the ilo too.

jwiz 5y ago

Sometimes the interface will piggyback on the same physical port as the primary NIC, so you can accidentally get it on the network without knowing. Supermicros default to using the dedicated nic for IPMI, but they also default to using the piggyback if there is no link on the dedicated nic. :(

mise_en_place 5y ago
Huh, I thought they listen on an invalid IP address by default for security reasons.
iso1210 5y ago
Which means everything is fine, then the ipmi switch port is shut down, and suddenly you're exposed in an unexpected fashion. It's not good. At least the password is no longer ADMIN/ADMIN on new kit, although I had one supermicro machine connected for me in India last week which was old enough that it was ADMIN/ADMIN

achillean 5y ago

Yes, they do. For example: https://threatpost.com/plaintext-supermicro-ipmi-credentials-exposed/106784/ https://threatpost.com/plaintext-supermicro-ipmi-credentials... Here's a search for some of them (requires a Shodan account): https://www.shodan.io/search?query=ssl%3Aipmi https://www.shodan.io/search?query=ssl%3Aipmi

MikeAshley178 5y ago
For those who don't have a Shodan Subscription you can use Open Datasets to find the same...and more https://github.com/tg12/rapid7_OSINT https://github.com/tg12/rapid7_OSINT

TheSmiddy 5y ago

Extremely lazy MSPs will port forward ports to BMCs instead of using a VPN or SSH tunnel.

redprince 5y ago

I like to quote the Internet Census of 2012 [1] whenever that question comes up: "A lot of devices and services we have seen during our research should never be connected to the public Internet at all. As a rule of thumb, if you believe that "nobody would connect that to the Internet, really nobody", there are at least 1000 people who did. Whenever you think "that shouldn't be on the Internet but will probably be found a few times" it's there a few hundred thousand times. Like half a million printers, or a Million Webcams, or devices that have root as a root password." [1] http://census2012.sourceforge.net/paper.html http://census2012.sourceforge.net/paper.html

spicybright 5y ago
Honestly an excellent rule of thumb.
dylan604 5y ago
> or a Million Webcams Um, like web is in the name. Othewise, good points

cm2187 5y ago

If you have a single server in colocation you may not have a choice. The only thing that allows me to sleep at night is that SM's IPMI has a firewall and you can whitelist a limited number of IPs.

iso1210 5y ago

They are often inline with eth0. Sometimes they have a dedicated ilo/ipmi/etc, but if that's not connected it sticks ilo on eth0. I once connected a server to a network and it wouldn't take the room's VGA KVM, so I started a dhcp server on my laptop to get onto the ipmi 63 leases were given out in a few seconds -- the lights-out (ilo, ipmi) that were on that network had never been configured, were just sat sending out dhcp requests and getting no response. The servers themselves were all statics, but nobody had bothered setting up the ilos. Most were of the age of a default password (ADMIN/ADMIN for supermicro for example) Now this is on a private network with internet via a proxy, so fairly bad, but not catastrophic. It shows how easy it is to connect something to the internet accidently though. Personally I put ilos on a dedicated vlan with an ACL blocking access to anywhere other than the management servers, it's not just incoming connections from the internet or from compromised machines behind your firewall, it's outgoing connections from the ilo too.