Facepalm: Attackers are targeting hardware that keeps modern servers running, with the weak point being the baseboard management controller (BMC) installed on the motherboard. New research shows that thousands of these controllers, shipped for years by major server manufacturers, remain exposed on the Internet and within corporate networks due to serious, long-standing flaws that are still easy to exploit.
Baseboard management controllers, or BMCs, are small computers built into nearly every enterprise server. They have their own firmware, operating system, network stack, and IP address. Administrators use them to reboot machines, install updates, reinstall operating systems, and monitor hardware, even when the main server is powered off or unresponsive.
That deep level of control makes BMCs valuable for IT operations but dangerous if attackers gain access. If compromised, a BMC can give an attacker control over the underlying server.
At the Black Hat security conference in Las Vegas, firmware security expert HD Moore, CEO and founder of runZero, presented new research showing that many of the weaknesses he identified back in 2013 are still present. He also revealed more than a dozen newly discovered vulnerabilities affecting BMCs from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and other vendors.
The core problem continues to center around IPMI, the protocol that allows BMCs to manage servers out of band.
“The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize,” Moore wrote in an email ahead of his talk.
To measure the scale of the exposure, Moore conducted two broad scans. One looked for BMCs accessible over the public Internet, while the other searched internal corporate networks.
The external scan found more than 86,000 BMCs with management services exposed to the public Internet. More than half of them (54%) had at least one critical vulnerability. As many as 75,000 remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows attackers to crack administrator passwords offline. Inside corporate networks, an internal scan of 126,761 BMCs found that nearly 29% contained one or more critical vulnerabilities.
The vulnerabilities Moore described affect multiple layers of the BMC stack. Some involve IPMI authentication, while others affect session security, memory management, and the handling of firmware and secrets.
One category of vulnerabilities stems from flaws in the IPMI authentication handshake. Attackers can manipulate the order of messages to bypass checks and gain a limited foothold in the BMC.
Affected products include HPE iLO, Supermicro, OpenBMC, and OpenBMC-derived systems from H3C and Nvidia. Once an attacker gains that foothold, additional vulnerabilities can be chained together to achieve full control.
Another set of vulnerabilities exists because IPMI does not always enforce integrity and encryption during sessions. “The device decides whether to authenticate and decrypt each packet from that attacker’s own header, and not from the algorithms the session negotiated, so an unsigned, unencrypted command is accepted on a secured session,” Moore said.
He developed a proof of concept that uses these flaws to “chain otherwise-unexploitable issues into full sessions.” Affected vendors include HPE, Supermicro, and legacy Intel systems.
Session IDs are another weak point in some systems. Instead of generating strong random values, some implementations create tokens based on simple counters or clock values, making them predictable.
An attacker can guess another user’s active BMC session and take control of it through both IPMI and browser-based KVM consoles. Moore said the two most serious vulnerabilities of this type affect Supermicro systems.
Moore also discovered pre-authentication memory corruption vulnerabilities. In HPE iLO systems, a length-validation flaw in the management SSH service can be exploited before authentication and used to execute attacker-controlled code. This provides a direct path to remote code execution on the BMC.
Firmware integrity is another area of concern. In some systems, firmware is unsigned or can be modified by attackers, while configuration integrity checks are not enforced. An authenticated administrator account could be abused to install a persistent implant or replace keys used for firmware verification. These weaknesses can also be combined with other vulnerabilities to bypass authentication and escalate privileges. Supermicro, H3C, and Dell are affected by these firmware-level issues.
The handling of secrets stored in firmware creates additional risks. Keys and constants embedded in publicly available firmware images can be extracted and reused as valid credentials. This can allow attackers to authenticate to BMCs or decrypt traffic. Moore identified this pattern in devices from Supermicro, OpenBMC, Huawei, and Dell.
Password practices make the situation worse. Many BMCs still rely on default or factory-generated credentials. With CVE-2013-4786, attackers can obtain password hashes and perform offline cracking attacks. Even when vendors randomize passwords before shipment, the available keyspaces can still be too small.
Moore found that HPE uses “eight digits or alphanum,” which he described as the weakest approach. Supermicro and Dell use somewhat longer default credentials that slow attacks but do not prevent them, extending password recovery attempts from hours to days depending on available computing power.
Although many of the newly discovered vulnerabilities require authentication to exploit, that barrier can often be bypassed by chaining them with pre-authentication flaws. In other cases, attackers who gain limited access can install older, vulnerable, or deliberately backdoored firmware on the BMC and then use control of the operating system to further modify the controller.
To help defenders understand their exposure, Moore released an open-source scanner called OOBscan. The tool allows administrators to scan entire server fleets for the BMC weaknesses he documented and begin addressing the most serious issues.
He also recommends several basic hardening measures: use long, unique usernames and complex passwords; disable IPMI and KCS when possible; block host-side access to the BMC; and isolate each BMC network interface instead of placing multiple controllers on a shared VLAN.
“BMCs are still an underrated risk,” Moore wrote. “This work points to the ecosystem being well behind the curve in terms of code quality and architecture.”
