I'm a little curious why the BMC hardware is even exposed to the customer at all. Is it provided as a feature or is this just an oversight? Can't they just hide all of this hardware from the customer's OS?
Bare metal customers get access to the whole machine. We get to access the BMC for remote management (console, power management, etc). Apparently, you can configure the BMC via tools running in the host OS, without needing to authenticate to the BMC; I've used this to fix BMC provisioning errors, that would otherwise require a SL tech to fix via physical console in the bios screen.
Ah, interesting. I wrongly assumed the SoftLayer bare metal servers might be closer to EC2's bare metal offerings where, from the outside, you're given the same set of management tools as a VM, and from the inside, a fairly limited hardware surface area is exposed to you.
It should sit on a physically separated network, with the firmware regularly updated.
Wasn't clear to me from the article whether the firmware was modified via the BMC's network interface or whether it was done locally over some hardware interface exposed to the customer's OS. Was this really done over the network?
Softlayer runs two separate networks, the public network, and the private network (vlans per customer, but also Softlayer tools are accessible from customer vlan, and customer vlan is accessible to Softlayer tools). The BMCs are connected to the private network. My understanding is that access to the BMC via the network is password protected, and customers don't get a password with enough access to flash via the network. Of course, older versions of the Supermicro BMC firmware had network accessible vulnerabilities, and current versions may have vulnerabilities as well. But impitool from the host can configure the BMC, and I suspect either flash the BMC or at least configure the BMC with a user that can flash it (or Supermicro tools can likely be run on the host to flash the BMC)