The Raritan Blog

University of Michigan Team Publishes Paper on BMC/IPMI Security Issues

Posted on September 6, 2013 by Richard Dominach

Security LockA University of Michigan team has published their research on IPMI and BMC security issues.  Entitled “Illuminating the Security Issues Surrounding Lights-Out Server Management,” this article follows up on the IPMI/BMC security issues highlighted by Dan Farmer and HD Moore as summarized in my previous blog on this subject. The Department of Homeland Security’s US-CERT team has posted an alert on the IPMI security risks.

The researchers provide an introduction to the issues, note the previous research, define IPMI/BMC security risks and analyze a particular implementation and describe their successful attack on this implementation.  They found “blatant textbook vulnerabilities” and concluded that the implementations “suggest either incompetence or indifference towards customer security.”  They then determine the number of publicly (Internet) accessible IPMI devices, which they determine to be more than 105,000.  They provide some defenses and lessons and indicate areas for future work.  The Washington Post has published an article on the paper and interviewed one of the authors, who criticizes the embedded device community for their security practices.

Customers who make use of BMC and IPMI based remote management cards and systems need to be aware of these issues and take the proper steps to safeguard their implementations.  Given the severity of these issues, they should consider alternative remote management solutions such as KVM-over-IP switches, which can avoid most of these risks.


Upcoming Events

West 2019
February 13 - 15  •  San Diego, CA
Data Center World Global 2019
March 19 - 22  •  Phoenix, AZ
Data Center Dynamics NY
April 9 - 10  •  New York, NY
NAB 2019 - National Association of Broadcasters Show
April 6 - 11  •  Las Vegas
Interop 19
May 20 - 23  •  Las Vegas, NV

View all Events

Latest Raritan News

Raritan’s New KVM-over-IP User Station Brings 4K Performance and Productivity to Remote Equipment Access
Posted on September 18, 2019
Raritan’s New 4K Ultra HD KVM-over-IP Switch Wins Best of Show Award at NAB
Posted on May 21, 2019
Raritan Unveils KVM-over-IP Switch with Enhanced Performance and 4K Ultra HD
Posted on April 4, 2019
Raritan Announces New SmartSensors™ for Accurate Insights on Data Center Environmental Health
Posted on January 28, 2019
Raritan Extends Reach of Remote Server Management with New KVM Product
Posted on November 26, 2018

View all news