The great mistake is that those servers have a management Ethernet interface connected to the Internet.
The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.
It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.
> The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.
The management ethernet port of most servers I've ever encountered is also, by default, bridged to the first non-management ethernet port in a failover configuration where if the dedicated port is not connected the management controller will connect to the "eth0" port instead.
> It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.
"Well if you just use it right the footgun is perfectly safe..."
Every industry has their own category of "rules written in blood" either metaphorically or literally, and a LOT of them come down to the fact that if there's a right way and a wrong way to do things, and the right way is not the path of least resistance, it's going to be done wrong constantly by everyone who thinks they can get away with it. You have to make your systems as easy as possible to do things the right way and as hard as possible to do things the wrong way.
If it can be connected directly to the internet it will be directly connected to the internet. There are a lot of people working in IT or performing entry level IT tasks in a company with no official IT who have only learned what they absolutely needed to to achieve their desired outcome. As the famous imgur comment says, "Human Engineering: As long as it does what I want it to do, it doesn't matter what else it does." They can access their server remotely and their thought process stopped there.
The default shipping configuration should be as secure as is practical to implement. Deprecating and disabling by default a protocol known to be insecure for decades seems like table stakes to me. They could still leave it present so those who had infrastructure depending on it could turn it on, but disable it by default on new hardware and present a prompt on firmware upgrades for older versions recommending it be disabled if not used. Other easy ones I could think of for server management controllers in particular would be to recommend either configuring an allowlist or even disabling the default gateway altogether so it's unable to directly communicate outside of the LAN.
Insecure-by-default "you should know better" is bad design. Yes, they should know better, but you know that a lot of them either won't know better or will be incentivized to not care.
I find it quite amusing what the so called security researches did spend the time to obscure the serial number 'CZ2D3J01XT' of their 'HPE ProLiant DL380 Gen11' server.
Who exactly wrote this spec?
How sure are we that it was an accident to share password hashes with the world?
The great mistake is that those servers have a management Ethernet interface connected to the Internet.
The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.
It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.
If that were true, it wouldn't have a password at all.
> The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.
The management ethernet port of most servers I've ever encountered is also, by default, bridged to the first non-management ethernet port in a failover configuration where if the dedicated port is not connected the management controller will connect to the "eth0" port instead.
> It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.
"Well if you just use it right the footgun is perfectly safe..."
Every industry has their own category of "rules written in blood" either metaphorically or literally, and a LOT of them come down to the fact that if there's a right way and a wrong way to do things, and the right way is not the path of least resistance, it's going to be done wrong constantly by everyone who thinks they can get away with it. You have to make your systems as easy as possible to do things the right way and as hard as possible to do things the wrong way.
If it can be connected directly to the internet it will be directly connected to the internet. There are a lot of people working in IT or performing entry level IT tasks in a company with no official IT who have only learned what they absolutely needed to to achieve their desired outcome. As the famous imgur comment says, "Human Engineering: As long as it does what I want it to do, it doesn't matter what else it does." They can access their server remotely and their thought process stopped there.
The default shipping configuration should be as secure as is practical to implement. Deprecating and disabling by default a protocol known to be insecure for decades seems like table stakes to me. They could still leave it present so those who had infrastructure depending on it could turn it on, but disable it by default on new hardware and present a prompt on firmware upgrades for older versions recommending it be disabled if not used. Other easy ones I could think of for server management controllers in particular would be to recommend either configuring an allowlist or even disabling the default gateway altogether so it's unable to directly communicate outside of the LAN.
Insecure-by-default "you should know better" is bad design. Yes, they should know better, but you know that a lot of them either won't know better or will be incentivized to not care.
I find it quite amusing what the so called security researches did spend the time to obscure the serial number 'CZ2D3J01XT' of their 'HPE ProLiant DL380 Gen11' server.
[flagged]