Feeds

207 thousand lights-out boxes are STILL hackable

A year after being warned, admins persist with 13 year old firmware

Beginner's guide to SSL certificates

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem.

The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year-old firmware that exposed operating systems to attack.

The BMCs provided Intelligent Platform Management Interface (IPMI) access over UDP allowing admins to remotely access downed consoles and supercomputer nodes.

The tests were conducted by researcher Dan Farmer, who was keen to understand if Metasploit founder HD Moore's July 2013 warning about the IPMI risks had been heeeded.

Farmer's report on his search, titled Sold Down the River (PDF), suggests the answer is a resounding "No".

"A world-wide scan of the IPMI protocol identified over 230,000 BMCs exposed to the internet, of which upwards of 90 percent could be compromised by just a handful of basic configuration and protocol weaknesses," Farmer wrote.

"The real exposure is even greater, as access to a BMC allows an attacker to compromise its host server as well as other BMCs within its management group, since they share common passwords."

The results served as a "canary in the coal mine" for what was anticipated widespread vulnerable out-of-band -- or lights-out -- IPMI platforms facing the internet.

Farmer was also highly critical of the protocol stating it was vulnerable by design and contained next to no documentation pointing users to ways to improve their security postures. "This was tantamount to major server manufacturers 'harming their customers', he said.

The situation was bad and set to worsen as more data was shipped into the cloud requiring greater use of the IPMI, Farmer suggests.

Of the 230,000 boxes trawled, 46.8 percent ran version 1.5 of BMC released in 2001 and almost all of these allowed attackers to log into any account, along with openings for man-in-the-middle hijackings.

"BMCs running 1.5 only had a single simple problem, but it’s a whopper - nearly all server management ports had the NULL authentication option set, meaning that all accounts could be logged into without authentication," Farmer wrote.

"Furthermore virtually all BMCs also had the NULL user enabled, by itself a problem but not a serious one, but working in tandem with the first it means that you can login to pretty much any older IPMI system without an account or a password."

Most consumers ran version IPMI version 2 released in 2006 which introduced better but badly flawed crypto security. The worst of these was 'cipher zero' which did not require authentication and was the most popular of 16 possible deployed ciphers.

The version also allowed Farmer to grab password hashes via RAKP key exchange cracking 30 percent of them with the popular John the Ripper tool. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.