Out of Order: protocol confusion attacks in the real world

The talk introduces IPMI, the network protocol used by baseboard management controllers to power servers on and off and read sensors independently of their operating system. It explains why these management chips are attractive targets: a compromise sits below the host OS, where endpoint tools cannot see it. Earlier research into weak default ciphers and firmware flaws is recapped as background.

The speaker then outlines protocol security, separating confidentiality and integrity from the application-layer bug classes that matter, such as cryptographic weaknesses, memory corruption and state machine flaws. Practical analysis methods are covered in turn: source review and static scanning, binary reverse engineering, live debugging, and coverage-guided fuzzing, which is awkward for network services. Applied to a software BMC implementation, the review found no checks on message ordering, and debugging showed that session key and privilege data persisted between sessions. Fuzzing turned up only minor memory issues.

Combining these observations produced an authentication bypass. An invalid session left an admin privilege value in memory, and a later session inherited it to send a power-off command without a password. The speaker reports that no instances of this software were found exposed online, and that the issue was reported to the maintainer. The takeaway is to enforce message order and session state at every step, clear session memory when it ends, and treat sequencing as a security property.