3 ms·
A BMC with vulnerabilities, what a surprise! But more seriously: > 2) Put in place automation processes for pushing patches/upgrades through the server operat
by someplaceguy 3y ago
A BMC with vulnerabilities, what a surprise!
But more seriously:
> 2) Put in place automation processes for pushing patches/upgrades through the server operating system itself.
> Organizations that rely on AMI-powered BMCs to manage their servers should install the updates as soon as possible.
Sure, this is much better than doing nothing, but if you're serious about security you should really take the other advice, which is to put them in another network, hopefully one that is not connected to the Internet (but still, update the firmware).
If your BMC contains anything remotely close to the complexity of a Linux kernel and you're not updating it weekly as bugs are fixed, expect to be vulnerable (like any other system).
- tinus_hn 3y agoYou mean like Intel Management Engine (IME), in every modern Intel processor, practically impossible to disable?
- someplaceguy 3y agoIndeed... and you can add the AMD PSP (in every modern AMD CPU), almost all SBC models (with the RPi and a select few others being notable exceptions) and almost every smartphone in the world...