Comment by ankhmoop | Hacker News Reader

Comment by ankhmoop | Hacker News Reader

Parent Full thread

Our servers actually have a full embedded ARM Linux installation to support IPMI[1]. It has a separate processor, power management, flash storage, et al, and operates independently of the installed OS. The onboard IPMI module runs as long as the machine is connected to a power source.

The card can be re-flashed from the running OS, and actually runs a number of open source network daemons with known vulnerabilities.

It can interact with the BIOS, provide network access to the console, access the network via the host's ethernet chipset, supply the OS with pseudo-disk devices (CD-ROM, floppy) ...

[1] http://en.wikipedia.org/wiki/Intelligent_Platform_Management...

Yes, a lot of servers have this. My point was more along the idea that as long as the FBI has the drives, they don't need anything else - so they should return everything except the original drives.

Wouldn't the FBI need to secure any onboard storage, including an embedded computer running Linux? Can they (currently) guarantee that they've found all locations on which evidence could be stored?

IPMI servers and related devices like Sun's LOM and HP's iLO have little to no storage space, perhaps a few MB of flash.

You can set up a limited number of users, like 16, and cannot store or access random data (i.e. you cannot use it like a 1GB USB drive). Of course, you could image that data, as there are tools under Linux etc. that let you read the IPMI / LOM / iLO information.

The management modules are often considerably more powerful than what is necessarily exposed via IPMI -- A number of SuperMicro's IPMI modules have more than a few megabytes of flash, and do run an embedded version of Linux.

The module's capabilities are not all that different from OpenWRT; they run Linux, have a network connection, provide a web UI including a 'VNC' server for the VGA console, run (IIRC) net-snmp ...

If I wanted to obscure my intentions, I definitely would leverage such non-obvious embedded systems.

Reply on news.ycombinator.com