4 ms·
Reasonable environments don't allow BMC access from the normal LAN, and instead have a protected LAN segment for the BMC's NIC, so the risk typically minimal as
by burnt-resistor 2mo ago
Reasonable environments don't allow BMC access from the normal LAN, and instead have a protected LAN segment for the BMC's NIC, so the risk typically minimal as it requires breaching a secure control network. It's bad to have insecure hardware, but defense-in-depth and proper network design makes compromise from it much more unlikely.
- hollow-moe 2mo ago> defense-in-depth and proper network design Damn, we're all doomed then
- inigyou 2mo agoThere is a a server I have whose host provides a VPN for customers onto the BMC network. I don't know if they are checking which IP address I access through the VPN, and I don't really want to find out lest I get terminated. There's another one from a host that just has it open to the internet. I bet you'd find a bunch by scanning the internet.
- burnt-resistor 2mo agoThis isn't the way. If you're in an engineering role, you have an ethical professional responsibility to do what's reasonably secure and pushback against unreasonable insecurity. I was once fired (forced to "resign") from a full-time job at a major university because I refused to rush weakening the security of a credit card processing network covered by PCI-DSS because a vendor couldn't figure out how a VPN works.
- inigyou 2mo agoFiring was the correct move. You may be protected for refusing to commit a crime, but violating PCI-DSS isn't a crime. Businesses are free to choose which of their contracts to violate and accept the risk attached to that. You could have anonymously reported the violation to the bank.