Thousands of Data Center Controllers Open to Takeover

Some 24,000 Internet-exposed server management controllers are vulnerable to a more than 20-year-old flaw that gives attackers a way to crack authentication credentials and gain privileged access to the underlying servers. The issue can evade conventional security tools because these management controllers operate independently of the server's operating system, kernel, containers, and workloads, and are therefore nearly invisible at those layers. Researchers at Lava discovered the flaw when researching Internet-exposed Baseboard Management Controllers (BMCs) for vulnerabilities and said it found evidence of attackers having exploited the issue in the wild. A BMC is a small, dedicated processor built into a server's motherboard. It operates separately from the server's main processor and operating system and gives administrators a way to remotely monitor and manage server hardware and functions like rebooting or powering servers on and off and checking system health. Admins can access the console even when the OS is down or the server is otherwise unresponsive. Administrators typically access BMCs through Intelligent Platform Management Interface (IPMI), an older protocol for remote hardware management; and Redfish, a newer API for managing server hardware over HTTPS and Web-based administrative interfaces. They can also use remote console or virtual media features for remotely accessing the server screen or attaching storage media, depending on the server platform. Because it...