Feeds

207 thousand lights-out boxes are STILL hackable

A year after being warned, admins persist with 13 year old firmware

Beginner's guide to SSL certificates

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem.

The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year-old firmware that exposed operating systems to attack.

The BMCs provided Intelligent Platform Management Interface (IPMI) access over UDP allowing admins to remotely access downed consoles and supercomputer nodes.

The tests were conducted by researcher Dan Farmer, who was keen to understand if Metasploit founder HD Moore's July 2013 warning about the IPMI risks had been heeeded.

Farmer's report on his search, titled Sold Down the River (PDF), suggests the answer is a resounding "No".

"A world-wide scan of the IPMI protocol identified over 230,000 BMCs exposed to the internet, of which upwards of 90 percent could be compromised by just a handful of basic configuration and protocol weaknesses," Farmer wrote.

"The real exposure is even greater, as access to a BMC allows an attacker to compromise its host server as well as other BMCs within its management group, since they share common passwords."

The results served as a "canary in the coal mine" for what was anticipated widespread vulnerable out-of-band -- or lights-out -- IPMI platforms facing the internet.

Farmer was also highly critical of the protocol stating it was vulnerable by design and contained next to no documentation pointing users to ways to improve their security postures. "This was tantamount to major server manufacturers 'harming their customers', he said.

The situation was bad and set to worsen as more data was shipped into the cloud requiring greater use of the IPMI, Farmer suggests.

Of the 230,000 boxes trawled, 46.8 percent ran version 1.5 of BMC released in 2001 and almost all of these allowed attackers to log into any account, along with openings for man-in-the-middle hijackings.

"BMCs running 1.5 only had a single simple problem, but it’s a whopper - nearly all server management ports had the NULL authentication option set, meaning that all accounts could be logged into without authentication," Farmer wrote.

"Furthermore virtually all BMCs also had the NULL user enabled, by itself a problem but not a serious one, but working in tandem with the first it means that you can login to pretty much any older IPMI system without an account or a password."

Most consumers ran version IPMI version 2 released in 2006 which introduced better but badly flawed crypto security. The worst of these was 'cipher zero' which did not require authentication and was the most popular of 16 possible deployed ciphers.

The version also allowed Farmer to grab password hashes via RAKP key exchange cracking 30 percent of them with the popular John the Ripper tool. ®

Beginner's guide to SSL certificates

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.