Hacker News Reader

Comment by parliament32 | Hacker News Reader

It depends. These chips were specifically connected to the BMC/IPMI:

>The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off.

Is your OOB-management VLAN/network firewalled off from outgoing access to the internet? If not, this chip can make requests out to another host, who gives it code to run. This code can then either collect data and send it back out, or do other nefarious things.

View on HN

The BMC is always on a maintenance vlan for any organization worth its salt. The software stack on those things doesn't deserve to see the light of the day. If you open it up to the internet, you will get pwned, china or not. So there seems to be something missing. It can't just be a compromised BMC.

Edit: Now that I think of it, a compromised BMC can inject payloads into the running OS, depending on the sophistication of the attack and the defenses of the OS. So it does seem possible.

Keep in mind that the BCM already has the ability to piggyback on the production interface if it decides the dedicated interface isn't connected to anything... what's to stop it from doing this in a mailicious scenario and fire off some garbage-looking dns/icmp/whatever?

Unless you're air-gapped you can usually assume that if the machines are syncing to public NTP then there's a way in and out.

Do people really set all their servers to point to someone else's NTP?

How many organizations actually watch what is coming in and out of their DNS?

I work for a company a couple orders of magnitude smaller than Apple/Amazon and we do. If you're in a production environment we're watching every network request, and there's no public access we don't want.

More anecdotes like this can be found at https://news.ycombinator.com/item?id=18138484 .

Reply on news.ycombinator.com