207 thousand lights-out boxes are STILL hackable

Researchers have found 207,000 publicly-accessible Baseboard Management Controllers (BMCs) can be hacked with a "handful" of basic command and config flaws, despite previous warnings about the problem.

The exposed devices were found during a global trawl of UDP 623 that netted 230,000 public BMCs, half of which ran holey 13-year-old firmware that exposed operating systems to attack.

The BMCs provided Intelligent Platform Management Interface (IPMI) access over UDP allowing admins to remotely access downed consoles and supercomputer nodes.

The tests were conducted by researcher Dan Farmer, who was keen to understand if Metasploit founder HD Moore's July 2013 warning about the IPMI risks had been heeeded.

Farmer's report on his search, titled Sold Down the River (PDF), suggests the answer is a resounding "No".

"A world-wide scan of the IPMI protocol identified over 230,000 BMCs exposed to the internet, of which upwards of 90 percent could be compromised by just a handful of basic configuration and protocol weaknesses," Farmer wrote.

"The real exposure is even greater, as access to a BMC allows an attacker to compromise its host server as well as other BMCs within its management group, since they share common passwords."

The results served as a "canary in the coal mine" for what was anticipated widespread vulnerable out-of-band -- or lights-out -- IPMI platforms facing the internet.

Farmer was also highly critical of the protocol stating it was vulnerable by design and contained next to no documentation pointing users to ways to improve their security postures. "This was tantamount to major server manufacturers 'harming their customers', he said.

The situation was bad and set to worsen as more data was shipped into the cloud requiring greater use of the IPMI, Farmer suggests.

Of the 230,000 boxes trawled, 46.8 percent ran version 1.5 of BMC released in 2001 and almost all of these allowed attackers to log into any account, along with openings for man-in-the-middle hijackings.

"BMCs running 1.5 only had a single simple problem, but it’s a whopper - nearly all server management ports had the NULL authentication option set, meaning that all accounts could be logged into without authentication," Farmer wrote.

"Furthermore virtually all BMCs also had the NULL user enabled, by itself a problem but not a serious one, but working in tandem with the first it means that you can login to pretty much any older IPMI system without an account or a password."

Most consumers ran version IPMI version 2 released in 2006 which introduced better but badly flawed crypto security. The worst of these was 'cipher zero' which did not require authentication and was the most popular of 16 possible deployed ciphers.

The version also allowed Farmer to grab password hashes via RAKP key exchange cracking 30 percent of them with the popular John the Ripper tool. ®