Hacker News Reader

Comment by Tiksi | Hacker News Reader

Yeah, I find it difficult to understand the hoopla around IME. It's not much different from the BMC that's on pretty much all server hardware.

View on HN

Let me make this totally clear. The top OEM hardware manufacturers couldn't give a CRAP about your security.

https://duo.com/blog/out-of-box-exploitation-a-security-anal...

e.g. http://teletext.zaibatsutel.net/post/145370716258/deadupdate...

But you're totally fine that THESE are the people with unfetted power to fill your system with backdoors? (Not to mention NSA etc who'd almost certainly have access).

What's wrong with you having zero care about the world's data security?

It's not so much that I don't care, more that it's nothing new.

I just don't understand why people are suddenly railing against IME instead of Dell, SuperMicro, HP, etc when there is far more hardware out there with far, far less secure BMCs and it's been that way for ages. IME is probably closer to the best of the bunch as far as security goes.

IME is horrible and we should be railing against all horrible implementations. I can assure you I let my OEM know full well how I felt about insecure automatic update software (even though I wipe the system as soon as I get it, something I can't do with ME). I'll be taking my next purchase elsewhere. Unless people speak up, it's guaranteed to only gets worse.

I think we're talking about two different things. BMCs run separately from the rest of the system and are active even when the machine is halted. They provide remote mouse/keyboard/monitor, power control, remote device mounting, bios settings, hardware sensors and monitoring, etc. These have been in servers for ages, do the same thing as IME, and are way less secure. None of it has any relevance to software updaters or software at all really since a lot of these boxes are shipped without an OS or even hard drives.

I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slightly more options (if slim). Agree it's not widely enough recognised either though. There's some coverage at least:

https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... https://isc.sans.edu/diary/IPMI%3A+Hacking+servers+that+are+... http://arstechnica.com/security/2013/08/remote-admin-tool-im... https://www.usenix.org/system/files/conference/woot13/woot13... https://community.rapid7.com/community/metasploit/blog/2013/... https://www.schneier.com/blog/archives/2013/01/the_eavesdrop... http://www.websecuritywatch.com/authentication-bypass-vulner... http://fish2.com/ipmi/itrain.pdf

Reply on news.ycombinator.com