Feeds

207 thousand lights-out boxes are STILL hackable

A year after being warned, admins persist with 13 year old firmware

New hybrid storage solutions

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem.

The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year-old firmware that exposed operating systems to attack.

The BMCs provided Intelligent Platform Management Interface (IPMI) access over UDP allowing admins to remotely access downed consoles and supercomputer nodes.

The tests were conducted by researcher Dan Farmer, who was keen to understand if Metasploit founder HD Moore's July 2013 warning about the IPMI risks had been heeeded.

Farmer's report on his search, titled Sold Down the River (PDF), suggests the answer is a resounding "No".

"A world-wide scan of the IPMI protocol identified over 230,000 BMCs exposed to the internet, of which upwards of 90 percent could be compromised by just a handful of basic configuration and protocol weaknesses," Farmer wrote.

"The real exposure is even greater, as access to a BMC allows an attacker to compromise its host server as well as other BMCs within its management group, since they share common passwords."

The results served as a "canary in the coal mine" for what was anticipated widespread vulnerable out-of-band -- or lights-out -- IPMI platforms facing the internet.

Farmer was also highly critical of the protocol stating it was vulnerable by design and contained next to no documentation pointing users to ways to improve their security postures. "This was tantamount to major server manufacturers 'harming their customers', he said.

The situation was bad and set to worsen as more data was shipped into the cloud requiring greater use of the IPMI, Farmer suggests.

Of the 230,000 boxes trawled, 46.8 percent ran version 1.5 of BMC released in 2001 and almost all of these allowed attackers to log into any account, along with openings for man-in-the-middle hijackings.

"BMCs running 1.5 only had a single simple problem, but it’s a whopper - nearly all server management ports had the NULL authentication option set, meaning that all accounts could be logged into without authentication," Farmer wrote.

"Furthermore virtually all BMCs also had the NULL user enabled, by itself a problem but not a serious one, but working in tandem with the first it means that you can login to pretty much any older IPMI system without an account or a password."

Most consumers ran version IPMI version 2 released in 2006 which introduced better but badly flawed crypto security. The worst of these was 'cipher zero' which did not require authentication and was the most popular of 16 possible deployed ciphers.

The version also allowed Farmer to grab password hashes via RAKP key exchange cracking 30 percent of them with the popular John the Ripper tool. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Enigmail PGP plugin forgets to encrypt mail sent as blind copies
User now 'waiting for the bad guys come and get me with their water-boards'
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.