InfoSecBulletin Cybersecurity for mankind
Thousands of data centers are in danger because of a 22-year-old problem in Baseboard Management Controller (BMC) processors, says the security company Lava. BMCs are found in many server platforms. They allow server management even if the operating system is not working. They are usually very important control points in a data center.
Administrators can use a BMC to restart the host, update firmware, change basic platform settings, check hardware sensors, and more. They can do this through different management methods, such as the IPMI protocol, the Redfish API, and a web admin interface.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“In many implementations, these interfaces share the same user database. A credential that works for IPMI may also work for the web interface or Redfish API. This matters because the IPMI authentication process can expose information that enables offline password recovery,” Lava notes.
Nearly 37,000 server-management interfaces are exposed on the internet and use the IPMI protocol, according to the cybersecurity company. More than 24,000 of these show password-based authentication hashes before login.
The core issue is CVE-2013-4786, a vulnerability introduced in 2004 in the IPMI 2.0 authentication protocol that allows attackers to obtain password hashes and crack them offline by “obtaining the HMAC from a RAKP message 2 response from a BMC,” a NIST advisory reads.
“During authentication, the BMC can return an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester. An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline,” Lava explains.
Attackers could use the security flaw to find weak, reused, or default passwords without needing to send a new request for each password. This is easier than making many login attempts online.
Lava found that 6,240 hosts let users sign in with no username and a weak password. Also, 2,340 of these had accounts like Admin or root that used passwords from well-known lists.
Some BMCs were using usual passwords and simple factory-set password types, as said by the cybersecurity company.
“This vulnerability exposes a broader security gap in the data center management plane. BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage. Combined with modern GPU cracking and predictable factory passwords, this vulnerability can turn a single exposed BMC into a privileged and difficult-to-detect foothold across the management network,” Lava notes.
