4 ms·

Now if only they took security seriously... A few years ago I reported a problem to them that they told me wasn't a problem. For many years their IPMI hardware

Now if only they took security seriously... A few years ago I reported a problem to them that they told me wasn't a problem. For many years their IPMI hardware would automatically switch to the primary motherboard ethernet interface if the IPMI dedicated ethernet port wasn't active at boot, and in spite of an overabundance of jumpers, there was NO WAY to physically disable this. You couldn't disable this in the BIOS settings, either. There was literally no setting or settings, anywhere, to disable or configure this. The closest there was to avoid IPMI compromise if you intended to use your primary ethernet for public Internet was to configure the IPMI to be on a VLAN that hopefully nobody could guess. In order to configure the port to always stay on the dedicated IPMI port, you had to have a full network setup and the ability to run a browser compatible with their management junk. Or, you had to make sure the IPMI port was ALWAYS active. To do this in hardware, the best thing was to install a hardware loopback jack in the IPMI ethernet, which is what I ended up doing for Supermicro machines all over the planet. Even if you use a browser to configure the BIOS settings, your machine is a failed BIOS battery away from possible compromise. I've seen instances where shipping machines via air cargo involved temperatures cold enough to cause BIOS settings to get lost. Perhaps all of the clients they care about are running enough servers in datacenters to justify separate racks and cages with separate, dedicated, physically safe networks... But some people and smaller businesses colocate one or just a few servers at a time, and the thought of being a dead battery away from 100% complete compromise is just... Well, it's stupid, to be honest. They said it wasn't a problem that concerned them, so they weren't going to fix it. Sounds about right for a multi-billion dollar company, now that I think about it.

nocsi 4y ago
I reported that around 7 years ago. They called it a feature - 'failover' so you can get inside a server in a fault scenario. To this day, you can still shodan scan for open supermicro ipmi web interfaces on the internet. Btw, if you didn't know, the SuperMicro ipmicfg utility makes it super easy to interface with the BMC and reset the IPMI from a booted system. From there, you can reconfigure IPMI then mount whatever ISO or slip in some shitty UEFI rootkit. SuperMicro fills need for me of offering the exact server configurations and in the sizes I need. They're also a favorite target for supply chain attacks. But otherwise, i can promise you they will never give a shit about security. I'm not even sure if it's a security thing, it might be that they have backdoor compliance to be implemented if they want to be able sell their hardware in north korea & sudan. It's probably just cost-effective to have all the servers be universally backdoorable - i know I don't mind when i come across supermicro servers on pentest engagements
- thghtihadanacct 4y ago
  This is where a pfsense box comes in handy

nocsi 4y ago

I reported that around 7 years ago. They called it a feature - 'failover' so you can get inside a server in a fault scenario. To this day, you can still shodan scan for open supermicro ipmi web interfaces on the internet. Btw, if you didn't know, the SuperMicro ipmicfg utility makes it super easy to interface with the BMC and reset the IPMI from a booted system. From there, you can reconfigure IPMI then mount whatever ISO or slip in some shitty UEFI rootkit. SuperMicro fills need for me of offering the exact server configurations and in the sizes I need. They're also a favorite target for supply chain attacks. But otherwise, i can promise you they will never give a shit about security. I'm not even sure if it's a security thing, it might be that they have backdoor compliance to be implemented if they want to be able sell their hardware in north korea & sudan. It's probably just cost-effective to have all the servers be universally backdoorable - i know I don't mind when i come across supermicro servers on pentest engagements

thghtihadanacct 4y ago
This is where a pfsense box comes in handy