Facepalm: Attackers are targeting hardware that keeps modern servers running, with the weak point being the baseboard management controller (BMC) installed on the motherboard. New research shows that thousands of these controllers, shipped for years by major server manufacturers, remain exposed on the Internet and within corporate networks due to serious, long-standing flaws that are still easy to exploit.
Baseboard management controllers, or BMCs, are small computers built into nearly every enterprise server. They have their own firmware, operating system, network stack, and IP address. Administrators use them to reboot machines, install updates, reinstall operating systems, and monitor hardware, even when the main server is powered off or unresponsive.
That deep level of control makes BMCs valuable for IT operations but dangerous if attackers gain access. If compromised, a BMC can give an attacker control over the underlying server.
At the Black Hat security conference in Las Vegas, firmware security expert HD Moore, CEO and founder of runZero, presented new research showing that many of the weaknesses he identified back in 2013 are still present. He also revealed more than a dozen newly discovered vulnerabilities affecting BMCs from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and other vendors.
The core problem continues to center around IPMI, the protocol that allows BMCs to manage servers out of band.
"The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize," Moore wrote in an email ahead of his talk.
To measure the scale of the exposure, Moore conducted two broad scans. One looked for BMCs accessible over the public Internet, while the other searched internal corporate networks.
The external scan found more than 86,000 BMCs with management services exposed to the public Internet. More than half of them (54%) had at least one critical vulnerability. As many as 75,000 remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows attackers to crack administrator passwords offline. Inside corporate networks, an internal scan of 126,761 BMCs found that nearly 29% contained one or more critical vulnerabilities.
The vulnerabilities Moore described affect multiple layers of the BMC stack. Some involve IPMI authentication, while others affect session security, memory management, and the handling of firmware and secrets.
One category of vulnerabilities stems from flaws in the IPMI authentication handshake. Attackers can manipulate the order of messages to bypass checks and gain a limited foothold in the BMC.
Affected products include HPE iLO, Supermicro, OpenBMC, and OpenBMC-derived systems from H3C and Nvidia. Once an attacker gains that foothold, additional vulnerabilities can be chained together to achieve full control.
Another set of vulnerabilities exists because IPMI does not always enforce integrity and encryption during sessions. "The device decides whether to authenticate and decrypt each packet from that attacker's own header, and not from the algorithms the session negotiated, so an unsigned, unencrypted command is accepted on a secured session," Moore said.
He developed a proof of concept that uses these flaws to "chain otherwise-unexploitable issues into full sessions." Affected vendors include HPE, Supermicro, and legacy Intel systems.
Session IDs are another weak point in some systems. Instead of generating strong random values, some implementations create tokens based on simple counters or clock values, making them predictable.
An attacker can guess another user's active BMC session and take control of it through both IPMI and browser-based KVM consoles. Moore said the two most serious vulnerabilities of this type affect Supermicro systems.