Breaking BMC: The Forgotten Key to the Kingdom
NVIDIA offensive researchers detail chaining a dozen vulnerabilities in AMI MegaRAC BMCs, demonstrating remote exploitation to flash persistent implants into server SPI flash.
Summary
The Baseboard Management Controller as a Critical Threat Vector
Baseboard Management Controllers (BMCs) are autonomous service processors on enterprise server motherboards that manage power states, console redirection, and remote firmware flashing.
Auditing AMI MegaRAC BMC Implementations
Alex Tereshkin and Adam Zabrocki examine the widely deployed AMI MegaRAC BMC codebase on enterprise hardware, mapping out network-accessible IPMI and HTTP management interfaces.
Chaining a Dozen Vulnerabilities to Server Firmware Control
The researchers detail an extensive exploit chain starting from zero-knowledge remote access to memory corruption, privilege escalation, and hypervisor-independent code execution.
Flashing Persistent Malicious Firmware into SPI Flash
Demonstrating permanent firmware flashing into the host server SPI flash illustrates how BMC compromise grants attackers undetectable, OS-reinstall-resilient server control.
Related talks
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.