4 ms·

It'd be nice if they gave a damn about security. I had clients stop buying them because a glaring security problem was determined to be "not an issue" that they

It'd be nice if they gave a damn about security. I had clients stop buying them because a glaring security problem was determined to be "not an issue" that they wouldn't fix. It's one thing to say they wouldn't or couldn't fix products already made with the flaw, but it's another entirely to have a culture of security that says, "Sure, this flaw could cause your machine full, unfettered compromise, but because it's not likely to happen and not highly publicized, we don't care." It makes me think they'll treat current and future security problems the same way. Security shouldn't be based on popularity contests. Sorry, but not for me.

gizmo 3y ago
Do you have more info on this? iDRAC doesn't have the best security track record either, but people don't really seem to care.
- dualboot 3y ago
  Indeed. An OOB interface is something you should always handle like radioactive material. It's volatile, powerful, and should be handled with extreme care and caution.
- johnklos 3y ago
  In a nutshell, the problem is this. I don't know whether this has changed, but this was true as of 2018 / 2019. Most of their motherboards have IPMI with a separate a management port. A good number of them share IPMI management with the motherboard's primary ethernet port by default if nothing is plugged in to the management port. The motherboards have no way to configure them to NOT share the primary ethernet port beyond having the full stack of software needed to configure their IPMI. What this means is that there're no jumpers one can change and no settings accessible in the BIOS that can force IPMI to stay on its own port, so if a BIOS gets reset, the battery dies or even just temporarily fails to provide power (like if it's being shipped by air and gets very cold), or you want to ship servers directly to a datacenter, the machine is 100% ownable on the public interface BY DEFAULT unless the management port is connected (and even then sometimes it decides to share the primary port - probably a function of link negotiation speed with the switch). Sure, it's not a common occurrence, but it happens. The solution for all the servers we already had deployed? We got ethernet loopback plugs for every one of them where the IPMI port wasn't already connected to a switch we administered. A reasonable response: "Sure, that could be a problem sometimes. We can't change motherboards we already sold, but we'll bring this up with our design team so there'll be a jumper you can change so sharing will never happen, even with a reset BIOS." Their response: "This isn't a security issue."
  - dilyevsky 3y ago
    This! And their bmc is trash and openbmc only ships on few boards (arm ones iirc)
  - secabeen 3y ago
    This is an interesting attack surface. Can you extend the risk out a bit? Assume that you have a vulnerable supermicro IPMI now exposed on a public interface. It has no IP address, and is presumably issuing DHCP DISCOVERs in an effort to get an IP. How do you reach the IPMI device to exploit it? What additional access do you need to get there? Root on another device on that public network would do, you could forge the necessary DHCP responses to get it configured with an IP address of your choosing. Non-root on another device on that network might also work, if it fails DHCP and self-configures on a 169.254 address, assuming it does that. Is there an obvious way to exploit such an issue from beyond the public subnet?Every attack I can imagine would be blocked by either inbound firewalls, or a failure to reach the IPMI as an unexpected device on the public subnet. I suppose that it would be a possible risk if you have a DHCP server on that public subnet issuing IP addresses to all devices, but that seems like a larger risk anyways. Server networks should be static assigned or static DHCP in all cases.
    - michaelt 3y ago
      Assume your network is not-entirely-trusted - like a college network where some curious students might be poking around and running network scans, and some others have malware on their computers. The expected network port is plugged in, so even if your switch is checking MAC addresses, everything is in order. Most networks use DHCP, so the IPMI picks up an IP address. A student finds it with their port scan.
      - secabeen 3y ago
        Interesting. I never use DHCP pools / random allocation on server networks; everything there is static assignment on the host, or static DHCP with whitelisted MAC.
    - dilyevsky 3y ago

gizmo 3y ago

Do you have more info on this? iDRAC doesn't have the best security track record either, but people don't really seem to care.

dualboot 3y ago
Indeed. An OOB interface is something you should always handle like radioactive material. It's volatile, powerful, and should be handled with extreme care and caution.
johnklos 3y ago
In a nutshell, the problem is this. I don't know whether this has changed, but this was true as of 2018 / 2019. Most of their motherboards have IPMI with a separate a management port. A good number of them share IPMI management with the motherboard's primary ethernet port by default if nothing is plugged in to the management port. The motherboards have no way to configure them to NOT share the primary ethernet port beyond having the full stack of software needed to configure their IPMI. What this means is that there're no jumpers one can change and no settings accessible in the BIOS that can force IPMI to stay on its own port, so if a BIOS gets reset, the battery dies or even just temporarily fails to provide power (like if it's being shipped by air and gets very cold), or you want to ship servers directly to a datacenter, the machine is 100% ownable on the public interface BY DEFAULT unless the management port is connected (and even then sometimes it decides to share the primary port - probably a function of link negotiation speed with the switch). Sure, it's not a common occurrence, but it happens. The solution for all the servers we already had deployed? We got ethernet loopback plugs for every one of them where the IPMI port wasn't already connected to a switch we administered. A reasonable response: "Sure, that could be a problem sometimes. We can't change motherboards we already sold, but we'll bring this up with our design team so there'll be a jumper you can change so sharing will never happen, even with a reset BIOS." Their response: "This isn't a security issue."
- dilyevsky 3y ago
  This! And their bmc is trash and openbmc only ships on few boards (arm ones iirc)
- secabeen 3y ago
  This is an interesting attack surface. Can you extend the risk out a bit? Assume that you have a vulnerable supermicro IPMI now exposed on a public interface. It has no IP address, and is presumably issuing DHCP DISCOVERs in an effort to get an IP. How do you reach the IPMI device to exploit it? What additional access do you need to get there? Root on another device on that public network would do, you could forge the necessary DHCP responses to get it configured with an IP address of your choosing. Non-root on another device on that network might also work, if it fails DHCP and self-configures on a 169.254 address, assuming it does that. Is there an obvious way to exploit such an issue from beyond the public subnet?Every attack I can imagine would be blocked by either inbound firewalls, or a failure to reach the IPMI as an unexpected device on the public subnet. I suppose that it would be a possible risk if you have a DHCP server on that public subnet issuing IP addresses to all devices, but that seems like a larger risk anyways. Server networks should be static assigned or static DHCP in all cases.
  - michaelt 3y ago
    Assume your network is not-entirely-trusted - like a college network where some curious students might be poking around and running network scans, and some others have malware on their computers. The expected network port is plugged in, so even if your switch is checking MAC addresses, everything is in order. Most networks use DHCP, so the IPMI picks up an IP address. A student finds it with their port scan.
    - secabeen 3y ago
      Interesting. I never use DHCP pools / random allocation on server networks; everything there is static assignment on the host, or static DHCP with whitelisted MAC.
  - dilyevsky 3y ago