Hacker News Reader

Comment by johnklos | Hacker News Reader

I reported a security issue in Supermicro's IPMI implementation to them. They dismissed the issue and never fixed it.

These companies don't care if there's no way to stop a remote control service (iLo, iDRAC, IPMI) from binding to a motherboard ethernet port. In the case of Supermicro, you can't configure via the built-in BIOS, there are no jumpers you can use, and you must have a full network setup and installed tools to configure a new machine. This makes deploying in the field much, much more problematic.

If the BIOS battery dies and settings set are lost, the motherboard defaults to joining whichever ethernet is active, with default credentials. It's incredibly stupid and insecure.

I will never buy Supermicro again, but for the hardware that was already bought, I mandated loopback plugs for all IPMI ports so the IPMI wouldn't switch to the system ethernet.

View on HN

Supermicro switched to unique default passwords (same as Dell/HPE) a few years back. Silly to not have day one but really when you look at any of these they are all a security nightmare.

Dell’s not root/Calvin anymore?

For most probably as you have to know to order it specifically with secure password unlike HPE/Supermicro which just do it every time now. Likely they got hit with a government/large customer requirement and half assed it, as most things BMC are.

It hasn't been for years now. The systems get a unique password from the factory and is on the tag.

Honest question: do people actually connect their ipmi / bmc to the public internet? Or is it something different that’s being exposed here?

I like to quote the Internet Census of 2012 [1] whenever that question comes up:

"A lot of devices and services we have seen during our research should never be connected to the public Internet at all. As a rule of thumb, if you believe that "nobody would connect that to the Internet, really nobody", there are at least 1000 people who did. Whenever you think "that shouldn't be on the Internet but will probably be found a few times" it's there a few hundred thousand times. Like half a million printers, or a Million Webcams, or devices that have root as a root password."

[1] http://census2012.sourceforge.net/paper.html

Honestly an excellent rule of thumb.

> or a Million Webcams

Um, like web is in the name. Othewise, good points

They are often inline with eth0. Sometimes they have a dedicated ilo/ipmi/etc, but if that's not connected it sticks ilo on eth0.

I once connected a server to a network and it wouldn't take the room's VGA KVM, so I started a dhcp server on my laptop to get onto the ipmi

63 leases were given out in a few seconds -- the lights-out (ilo, ipmi) that were on that network had never been configured, were just sat sending out dhcp requests and getting no response. The servers themselves were all statics, but nobody had bothered setting up the ilos. Most were of the age of a default password (ADMIN/ADMIN for supermicro for example)

Now this is on a private network with internet via a proxy, so fairly bad, but not catastrophic. It shows how easy it is to connect something to the internet accidently though.

Personally I put ilos on a dedicated vlan with an ACL blocking access to anywhere other than the management servers, it's not just incoming connections from the internet or from compromised machines behind your firewall, it's outgoing connections from the ilo too.

Yes, they do. For example:

https://threatpost.com/plaintext-supermicro-ipmi-credentials...

Here's a search for some of them (requires a Shodan account):

https://www.shodan.io/search?query=ssl%3Aipmi

For those who don't have a Shodan Subscription you can use Open Datasets to find the same...and more

https://github.com/tg12/rapid7_OSINT

Sometimes the interface will piggyback on the same physical port as the primary NIC, so you can accidentally get it on the network without knowing.

Supermicros default to using the dedicated nic for IPMI, but they also default to using the piggyback if there is no link on the dedicated nic. :(

Which means everything is fine, then the ipmi switch port is shut down, and suddenly you're exposed in an unexpected fashion. It's not good. At least the password is no longer ADMIN/ADMIN on new kit, although I had one supermicro machine connected for me in India last week which was old enough that it was ADMIN/ADMIN

Huh, I thought they listen on an invalid IP address by default for security reasons.

If you have a single server in colocation you may not have a choice. The only thing that allows me to sleep at night is that SM's IPMI has a firewall and you can whitelist a limited number of IPs.

Extremely lazy MSPs will port forward ports to BMCs instead of using a VPN or SSH tunnel.

Reply on news.ycombinator.com