Lights Out - Out of Band, Out of Mind, Out of Control

The talk looks at baseboard management controllers, the always-on secondary computers built into enterprise servers. These devices run their own operating system and network stack, often share a network port with the host, and have been poorly secured since IPMI was criticized in 2013. The speaker explains how they end up exposed, both on the internet and on corporate networks.

The research team scanned about 15,000 internet-facing and 125,000 internal devices. They found that many systems returned RAKP password hashes without any credentials, and they cracked thousands of them offline. The talk walks through a chain of authentication flaws: handshake state confusion, session privilege relabeling, skipped integrity and encryption checks, a default key in OpenBMC, and a KVM token derived from the clock. Vendor-specific problems are covered too, including a hardcoded Supermicro password and a Dell attempt to block IPMI that only applied to IPv4. Once a controller is compromised, the speaker shows how its access to host memory over internal buses and DMA can reach the host, and how the factory password scheme made default passwords easier to crack.

The main takeaways are to disable the host-side KCS interface, keep the management NIC on a dedicated network, and treat BMC firmware as part of the trust boundary. The speaker released OOBscan, an open-source IPMI exploitation tool, along with a John the Ripper patch for the new hash format, and noted that most issues remain unpatched.