Illuminating the security issues surrounding lights-out server management
Anthony J. Bonkoski, Russ Bielawski, J. Alex Halderman · 2013
Out-of-band, lights-out management has become a stan-dard feature on many servers, but while this technology can be a boon for system administrators, it also presents a new and interesting vector for attack. This paper exam-ines the security implications of the Intelligent Platform Management Interface (IPMI), which is implemented on server motherboards using an embedded Baseboard Man-agement Controller (BMC). We consider the threats posed by an incorrectly implemented IPMI and present evidence that IPMI vulnerabilities may be widespread. We analyze a major OEM’s IPMI implementation and discover that it is riddled with textbook vulnerabilities, some of which would allow a remote attacker to gain root access to the BMC and potentially take control of the host system. Us-ing data from Internet-wide scans, we find that there are at least 100,000 IPMI-enabled servers (across three large vendors) running on publicly accessible IP addresses, con-trary to recommended best practice. Finally, we suggest defensive strategies for servers currently deployed and propose avenues for future work. 1