Illuminating the security issues surrounding lights-out server management

7th USENIX Workshop on Offensive Technologies, WOOT 2013

Volumn , Issue , 2013, Pages

  Bonkoski, Anthony J ^a   Bielawski, Russ ^a   Alex Halderman, J ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DEFENSIVE STRATEGIES; INTELLIGENT PLATFORM MANAGEMENT INTERFACES; MANAGEMENT CONTROLLER; PUBLICLY ACCESSIBLE; SECURITY IMPLICATIONS; SERVER MANAGEMENT; SURROUNDING LIGHTS; SYSTEM ADMINISTRATORS;

EID: 85084163455     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (25)

1. Aleph One. Smashing the stack for fun and profit. Phrack, 7(49), August 1996.
2. Floris Bos. Supermicro IPMI documentation omission: presence of second admin account. Full Disclosure mailing list, October 2011. http://seclists.org/fulldisclosure/2011/Oct/530.
3. brc csf. Supermicro IPMI security. Web Hosting Talk forum post, October 2010. http://www.webhostingtalk.com/showthread.php?t=992082.
4. Michael Davis, Sean Bodmer, and Aaron LeMasters. Hacking Exposed: Malware and Rootkits. McGraw-Hill, 2009.
5. Dell. Integrated Dell Remote Access Controller 7 (iDRAC7) user’s guide, 1.30.30 edition, December 2012.
6. Zakir Durumeric, Eric Wustrow, and J. Alex Halderman. ZMap: Fast Internet-wide scanning and its security applications. In 22nd USENIX Security Symposium, August 2013.
7. Dan Farmer. Dell backdoor, January 2013. http://fish2.com/ipmi/dell/secret.html.
8. Dan Farmer. IPMI: Freight train to hell, January 2013. http://fish2.com/ipmi/itrain.html.
9. John Heasman. Implementing and detecting an ACPI BIOS rootkit. Talk at Black Hat Europe, 2006. http://www.blackhat.com/presentations/bh-europe06/bh-eu-06-Heasman.pdf.
10. Craig Heffner. Binwalk: Firmware analysis tool. https://code.google.com/p/binwalk/.
11. Hewlett-Packard. HP Integrated Lights-Out security, 7 edition, December 2010. http://bizsupport2.austin.hp.com/ bc/docs/support/SupportManual/c00212796/ c00212796.pdf.
12. Hewlett-Packard. HP ProLiant Lights Out-100 User Guide, March 2010. http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02063205/ c02063205.pdf.
13. Hewlett-Packard. HP iLO 3 User Guide, October 2012. http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c02774507/c02774507.pdf.
14. Independent Security Evaluators. Exploiting SOHO routers, April 2013. http://securityevaluators.com/content/case-studies/routers/soho router hacks.jsp.
15. Intel, Hewlett-Packard, NEC, and Dell. Intelligent Platform Management Interface Specification v2.0, February 2004. http://www.intel.com/content/dam/www/public/us/en/documents/product-briefs/ second-gen-interface-spec-v2-rev1-4.pdf.
16. Gene H. Kim and Eugene H. Spafford. The design and implementation of tripwire: a file system integrity checker. In 2nd ACM Conference on Computer and Communications Security, CCS’94, pages 18–29, 1994.
17. Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad Verbowski, Helen J. Wang, and Jacob R. Lorch. SubVirt: Implementing malware with virtual machines. In 27th IEEE Symposium on Security and Privacy, SP’06, 2006.
18. HD Moore. Security flaws in Universal Plug and Play: Unplug, don’t play, January 2013. https://community.rapid7.com/docs/DOC-2150.
19. HD Moore, Alex Eubanks, and Richard Harman. Metasploit module for uPnP attack on Supermicro IPMI devices, February 2013. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/ multi/upnp/libupnp ssdp overflow.rb.
20. Jay Novak, Jonathan Stribley, Kenneth Meagher, and J. Alex Halderman. Absolute pwnage: Security risks of remote administration tools. In 15th International Financial Cryptography Conference (FC), February 2011.
21. Weimin Pan and Haihong Zhuo. IPMI configuration on ninth-generation Dell PowerEdge servers. Dell Power Solutions, August 2006. http://www.dell.com/downloads/global/power/ps3q06-20050317-Zhuo.pdf.
22. Joanna Rutkowska. Introducing Blue Pill. The Invisible Things Lab’s blog, June 2006. http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html.
23. Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, and Dan Boneh. On the effectiveness of address-space randomization. In 11th ACM conference on Computer and Communications Security, CCS ’04, pages 298–307, 2004.
24. Supermicro. SMT IPMI User’s Guide, 2.1c edition, 2013. http://supermicro.com/manuals/other/SMT IPMI Manual.pdf.
25. Johannes Ullrich. IPMI: Hacking servers that are turned “off”. ISC Diary blog, June 2012. https://isc.sans.edu/diary/IPMI%3Aminimal+Hacking+servers+that+are+turned+%22off%22/13399.