Most business servers have a second, smaller computer built into the motherboard that almost nobody thinks about. It is called a baseboard management controller, or BMC, and it has its own firmware, its own operating system and its own network address. Your IT provider uses it to reboot the server, reinstall the operating system or check on the hardware, even when the main machine is switched off.
That is exactly why it matters. Whoever controls the BMC controls the server, no matter what security you have running inside it.
At the Black Hat security conference this month, researcher HD Moore of runZero presented scan results that should make any business with an on-premises server sit up. More than 86,000 of these management controllers were found sitting on the public internet, and 54 per cent of them carried a critical vulnerability. A broader scan of over 126,000 controllers found 29 per cent had at least one critical flaw. Around 75,000 were still exposed to a weakness in the IPMI protocol that was first published back in 2013 and lets an attacker crack the password offline.
The affected gear is not obscure. The list spans HPE iLO, Dell, Lenovo, Supermicro, Huawei, Nvidia and others. To be clear, this is research, not a reported breach. Nobody has said your server has been broken into. It does mean a lot of hardware is sitting there waiting.
The fixes are unglamorous and effective. The management port should never be reachable from the internet, and ideally sits on its own isolated network that only your IT people can reach. Default and shared passwords need to go. Older protocols like IPMI should be turned off where the hardware allows it. Firmware needs updating like anything else.
If you have a server in a cupboard or a comms room, the question worth asking your IT provider today is simple: is our server management interface reachable from the internet, and when was its firmware last updated?
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.