4 ms·
"If a potential attacker already has administrative access to the BMC..." Then you've already lost. The BMC needs to be ideally on a physically isolated netwo
by SoftTalker 1y ago
"If a potential attacker already has administrative access to the BMC..."
Then you've already lost.
The BMC needs to be ideally on a physically isolated network, or at least a separate one that has no route from the outside nor on the machine itself.
- Aurornis 1y agoThat’s a cop-out. It should be the case that even administrator access should not be abusable to implant permanent backdoors. Anything that makes privileges escalation exploits more damaging is a real problem. I’m getting tired of how these are being dismissed as if admin access should mean that you can ignore any security issues. There are things that even admin accounts should not be able to change at the hardware level, or if they can they must be reversible in the future by another user with admin access. > The BMC needs to be ideally on a physically isolated network, or at least a separate one that has no route from the outside nor on the machine itself. This is good practice but it shouldn’t excuse poor security at the hardware level. Supermicro motherboards also commonly default to having a feature that bonds the BMC network interface to one of the main NICs if you don’t plug a cable into the BMC interface. It’s common for people to be surprised that their BMC is exposed on their main network because they didn’t plug in a cable on the BMC NIC port at all.
- SoftTalker 1y agoI don't disagree, but if you have admin access to the BMC you can access the console, reboot the machine into single-user mode or even into another OS entirely, and then implant any malware you want, wipe the storage, etc. Some of the Supermicro boards don't even have a separate BMC NIC, the only choice is to bond it to one of the main NICs or sacrifice one of them to be BMC only. I try to pay attention to that now after being surprised by that once on some servers we bought.
- Aurornis 1y ago> I don't disagree, but if you have admin access to the BMC you can access the console, reboot the machine into single-user mode or even into another OS entirely, and then implant any malware you want, wipe the storage, etc. Yes, all of which can be reversed by another admin in the future. That is expected. It should not be the case that getting admin access one time can result in modifying the hardware in a way that can’t be reversed by future admin, short of physically reflashing the chip on the board.
- buckle8017 1y agoThat is believe it or not true for nearly every computer on the planet. If you have admin on windows you can flash the bios on regular motherboards with firmware that refuses to change.
- lmz 1y ago> If you have admin on windows you can flash the bios on regular motherboards with firmware that refuses to change. The vendors even sell this as downgrade prevention!
- adastra22 1y agoHuh? I don’t understand what you are getting at. Every PC I’ve had uses a very simple protocol for bit banging new firmware.
- buckle8017 1y agoWhich only worked because the existing firmware let's it.
- adastra22 1y agoFlashing the EEPROM doesn’t involve the firmware.
- labcomputer 1y ago
- jcgl 1y ago> but if you have admin access to the BMC you can access the console, reboot the machine into single-user mode or even into another OS entirely, and then implant any malware you want, wipe the storage, etc. True in the common case, but this can/should be guarded against by disk encryption and secured boot chains.
- AnthonyMouse 1y ago> It should be the case that even administrator access should not be abusable to implant permanent backdoors. It's really the "permanently" which is the design flaw. Boards should have a mechanism to recover from bad firmware, and the same mechanism is useful to recover from a bad flash. Make the flash chip removable, or leave a JTAG. Or have a bit of actual ROM with the write lines not even connected and just enough of a firmware to be able to reflash the main one.
- monster_truck 1y agoIt is removable, by desoldering. This is not uncommon and Ars's sensationalized reporting does not help This is exactly the kind of barrier you want for something with so much power over the system, otherwise you're not much better off than where you started as physical access allows for quick swaps of chips.
- AnthonyMouse 1y agoDesoldering is ridiculous. It's much more likely to damage the board, requires a much less common level of skill and doesn't allow you to check the existing data or do the reset prophylactically without performing the dangerous and expensive operation. Meanwhile it provides no meaningful resistance against physical access because someone with physical access can swap the entire board or a dozen other things.
- glii 1y agoMany Supermicro server motherboards I've seen place both the BIOS flash chip and the BMC firmware flash chip in a SOIC socket, so that the flash chip can absolutely be removed without desoldering.
- crest 1y agoAfaik the SuperMicro still uses non-BGA flash chips that can be accessed with a vampire clamp without desoldering.
- pastage 1y ago
- userbinator 1y agoIt should be the case that even administrator access should not be abusable If administrator access is equivalent to ownership, then I strongly disagree.
- adastra22 1y agoEven as an owner, you should not be able to arbitrarily restrict the rights of future owners.
- userbinator 1y agoUnfortunately the existence of things like efuses and OTP makes that very difficult.
- ohyoutravel 1y agoNo more hole sawing my old hard drives for me, lest I restrict rights of future owners to use the drives as storage devices.
- DangitBobby 1y agoWell they'd still have the right, just not the ability (this is actually a distinction US courts have made regarding arbitration clauses and legal recourse).
- Dylan16807 1y agoUnless you got it to saw itself via administrator access you've drifted off the intent of this conversation.
- shakna 1y agoAs an administrator, you generally expect to be able to change your mind at some point. Flashing data? Fine. Permanent? Not so much.
- ang_cire 1y ago
- formerly_proven 1y ago> Supermicro motherboards also commonly default to having a feature that bonds the BMC network interface to one of the main NICs if you don’t plug a cable into the BMC interface. It’s common for people to be surprised that their BMC is exposed on their main network because they didn’t plug in a cable on the BMC NIC port at all. Even if you changed the default from "failover" in the firmware you're just one CMOS reset (for whatever reason) away from it reverting back to putting the BMC on whatever network interface. This should really be something you can jumper off.
- ForOldHack 1y agoBoth, If you need to upgrade the firmware often, have a switch on the front of the case, like everything physical access needs to be the barrier.
- projektfu 1y agoI've made an effort but I can't find where this is truly irreversible. It just talks about usual things like reinstalling the OS not working because the malware is active before EFI. I didn't see reference in either this article or the linked one from Binarly.
- preisschild 1y agoI dont agree. It should be possible to flash another BMC software such as OpenBMC for example.
- znpy 1y ago> It’s common for people to be surprised that their BMC is exposed on their main network because they didn’t plug in a cable on the BMC NIC port at all. Is this documented? If it's documented, it's not an excuse for not reading documentation. You're not supposed to throw stuff (hardware or software) in production without reading the documentation.
- perching_aix 1y agoI don't work with physical servers, so this is a gap in my knowledge. Isn't it the entire purpose of BMCs to allow for remote management? So you'd definitely have to have it connected to the internet somehow, even if very indirectly, and in an independent manner (different network with no direct routes).
- xorcist 1y agoOf course a network can be offline. I believe that is what you describe, a network with no routes is not connected to anything else, and certainly not to the Internet? It is common to keep admin and backup functions on separate network interfaces, on a disconnected network. You have to physically connect to the network in a secure location to use it.
- ang_cire 1y agoNo, that is not common. Management networks are almost never air gapped, they're just segregated from publicly-accessible or higher-exposure networks (DMZ, and hopefully prod). Requiring a (role-restricted) VPN connection is the most common way to control access to management networks.
- nucleardog 1y agoYes, you need some way to connect to the BMC. That is never going to be something like "eh just throw it on the public internet" or similar. It's going on a separate, isolated network with strict access controls. There are others here more qualified to comment, but I do have some old rack mount enterprise servers making a racket in my basement, so I can provide some sort of half-informed opinion here-- Besides the security issue with the BMC here, it sounds like SuperMicro _also_ has absolutely insane defaults. Every system I have has a separate, dedicated NIC for the BMC. There is an _option_ which is disabled by default to instead have it share one of the other interfaces. So the only ways you're going to "accidentally" put the BMC on an insecure network are: 1. Rebooting the server, going into the BIOS configuration, going into the options for the BMC, and explicitly telling it which other network device to use. 2. Physically accessing the server, attaching an ethernet cable to a clearly labelled BMC port, and attaching the other end to an insecure network. From what I'm reading here, SuperMicro's default approach is apparently more "eh, just use whatever happens to be plugged in at the time". So even if you do have it running on a separate, secure interface... if someone unplugs it, it's going to switch to using whatever other connection is available! To connect to the BMC on my servers you first need to be on the internal network already. Then you connect via wireguard to the router on the rack. Then you can connect to it and given a username/password you can log in. I would be pretty pissed if a cable got unplugged and that meant that the server decided to instead throw the BMC _on the interface connected directly to the public friggin' internet_. And this is just equipment I use for play and hosting my own random junk!
- UltraSane 1y agoThis means that any sysadmin could plant a backdoor for later use.
- ahdanggit 1y agoand/or someone "renting" a bare metal server from such a provider too.
- Spooky23 1y agoThat's a an unimaginative assertion for this risk. How do you track the chain of custody of your servers? Do you sample them at random to ensure they aren't compromised? Bloomberg never backed away from their story about Chinese implants in Supermicro servers. Perhaps this is why?
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- burnt-resistor 1y agoYep. Defense in depth. Port-based VLAN at a minimum. Only total morons place their web-based and ssh remote/KVM management directly on the internet. Note that many Supermicro boards permit (as an option) to use the regular on-board NICs reducing the need to install a second or third cable for the BMC only adapter on mixed networks. Generally, one shouldn't be placing any box of any sort directly on the 'net unless it's hardened and behind sufficient network/application filtering.
- riddley 1y agoI own more than one used SuperMicro servers.
- mmsc 1y ago> rent a server > infect it with unremovable backdoor > stop paying server so company rents server to somebody else > ???? > profit!