Feeds

207 thousand lights-out boxes are STILL hackable

A year after being warned, admins persist with 13 year old firmware

The Essential Guide to IT Transformation

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem.

The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year-old firmware that exposed operating systems to attack.

The BMCs provided Intelligent Platform Management Interface (IPMI) access over UDP allowing admins to remotely access downed consoles and supercomputer nodes.

The tests were conducted by researcher Dan Farmer, who was keen to understand if Metasploit founder HD Moore's July 2013 warning about the IPMI risks had been heeeded.

Farmer's report on his search, titled Sold Down the River (PDF), suggests the answer is a resounding "No".

"A world-wide scan of the IPMI protocol identified over 230,000 BMCs exposed to the internet, of which upwards of 90 percent could be compromised by just a handful of basic configuration and protocol weaknesses," Farmer wrote.

"The real exposure is even greater, as access to a BMC allows an attacker to compromise its host server as well as other BMCs within its management group, since they share common passwords."

The results served as a "canary in the coal mine" for what was anticipated widespread vulnerable out-of-band -- or lights-out -- IPMI platforms facing the internet.

Farmer was also highly critical of the protocol stating it was vulnerable by design and contained next to no documentation pointing users to ways to improve their security postures. "This was tantamount to major server manufacturers 'harming their customers', he said.

The situation was bad and set to worsen as more data was shipped into the cloud requiring greater use of the IPMI, Farmer suggests.

Of the 230,000 boxes trawled, 46.8 percent ran version 1.5 of BMC released in 2001 and almost all of these allowed attackers to log into any account, along with openings for man-in-the-middle hijackings.

"BMCs running 1.5 only had a single simple problem, but it’s a whopper - nearly all server management ports had the NULL authentication option set, meaning that all accounts could be logged into without authentication," Farmer wrote.

"Furthermore virtually all BMCs also had the NULL user enabled, by itself a problem but not a serious one, but working in tandem with the first it means that you can login to pretty much any older IPMI system without an account or a password."

Most consumers ran version IPMI version 2 released in 2006 which introduced better but badly flawed crypto security. The worst of these was 'cipher zero' which did not require authentication and was the most popular of 16 possible deployed ciphers.

The version also allowed Farmer to grab password hashes via RAKP key exchange cracking 30 percent of them with the popular John the Ripper tool. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.