Unmasking the Vulnerabilities of Baseboard Management Controllers in Data Centers

The hidden realm beneath operating systems in enterprise servers has emerged as a focal point for cybercriminals, particularly through the exploitation of Baseboard Management Controllers (BMCs). These controllers, often running outdated protocols, are inadvertently becoming gateways for attackers, as highlighted by findings from security experts at Lava.

According to Lava’s red team, they were able to compromise various BMCs in mere minutes, leveraging weak passwords to gain remote control without needing physical access. Their investigation found that prominent server vendors, including Supermicro and HPE, are particularly vulnerable due to the inadequate security measures surrounding BMCs, which manage critical data center functions.

“BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage,” explained Michael Katchinskiy, Lava’s head of security research. Most security measures target operating systems and applications, overlooking the BMCs that operate outside these protections, granting attackers the ability to manipulate systems invisibly.

Explaining the Threats Posed by BMCs

BMCs are specialized microcontrollers accessed via out-of-band management, independent of the main CPU and operating system. This allows administrators to execute troubleshooting, firmware updates, and configuration changes. Unfortunately, this privileged access point is largely unguarded, making it a prime target.

The vulnerabilities arise from flaws in the out-of-band IPMI 2.0 authentication protocol (CVE-2013-4786), which was disclosed in 2013. Lava's team identified an alarming 36,872 BMCs publicly accessible via the internet, with approximately 66% revealing authentication hashes. These hashes serve as scrambled passwords that hackers can recover by taking them offline for analysis.

The research revealed that over 30% of these hashes were either weak, factory-set, or predictable passwords. In many cases, retrieving the actual passwords was a straightforward task. Strikingly, nearly 17% of the BMCs accepted empty username entries combined with weak passwords, allowing even easier access for intruders.

Interestingly, while Supermicro devices constituted more than half of the compromised BMCs, their credentials designed post-2019 did not match the researchers’ password lists. This was an important step toward enhancing security, showing the company's responsiveness to past vulnerabilities.

The Ramifications of Vulnerable BMCs

The dangers of these vulnerabilities extend far beyond individual servers. BMCs are often part of shared out-of-band management networks, where administrative accounts are reused, creating a risk of widespread complications following a breach. As Katchinskiy cautions, once a BMC is compromised, attackers can execute persistent changes that could survive operating system reinstalls and standard security responses.

This threat escalates in environments housing GPU clouds and neocloud infrastructures, which might involve extensive interconnected systems used by multiple clients. The interconnectedness of these systems means that a breach in one BMC can lead to access across various data center infrastructures, disrupting extensive operations and impacting multiple organizations.

In the data centers evaluated, the management networks revealed poor segmentation and inadequate access controls. This lack of fortification means that attackers can leverage a compromised BMC as a launching pad to infiltrate additional servers and ultimately target critical infrastructure.

Why BMC Security Is Frequently Neglected

Many IT departments focus their security efforts on components that seem more immediate, often overlooking components such as BMCs because they operate outside the standard network topology. This oversight results from the perception that devices which appear air-gapped are secure when, in reality, they can still be targeted from within a shared network.

David Shipley from Beauceron Security emphasizes that BMCs often fall between the cracks in organizational structures, lacking clear ownership, which leads to neglect. This allows hackers to execute various disruptive actions easily, from powering off devices to potential full server reimaging.

Addressing the BMC Vulnerability Challenge

According to Katchinskiy, the solution to these problems appears straightforward: prevent IPMI and Redfish interfaces from being exposed to the public internet. To bolster the security of BMCs, organizations should implement the following measures:

• Change factory-issued passwords immediately upon deployment.
• Limit BMC access to a private management network or through a secured VPN.
• Enforce stringent access controls to ensure only authorized personnel can reach BMC interfaces.
• Disable outdated and insecure protocols, including IPMI 1.5, as well as anonymous access options.
• Regularly monitor management networks and user activity separately from production workloads.

By treating management layers as critical security infrastructures and consistently revisiting password protocols and access policies, organizations can significantly reduce their risk profile. The key is not only in patching immediate vulnerabilities but in fostering a culture of proactive management across all facets of their IT infrastructure.