Thousands of servers can be backdoored by exploiting buggy motherboard controllers

Summary

Thousands of servers are vulnerable to remote backdoors due to critical flaws in motherboard controllers. These vulnerabilities, some over a decade old, affect major manufacturers and allow deep system access. Mitigation requires immediate patching and security best practices.

Key Takeaways

1. Thousands of Internet-connected servers sold by the world’s biggest manufacturers can be remotely backdoored by exploiting critical vulnerabilities that lurk deep inside system motherboards.
2. The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize.
3. Administrators can use OOBscan to scan their entire fleet of servers to detect the growing list of BMC vulnerabilities he has cataloged.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents research from a security expert and details specific vulnerabilities with vendor information. It cites a security conference and a cybersecurity agency, lending significant weight to its claims. The inclusion of a tool for detection and mitigation further enhances its credibility.

Bias assessment: Technical Security Reporting. The article focuses on technical details of security vulnerabilities and their implications. It avoids emotional language or partisan framing, presenting information objectively. The primary lens is that of cybersecurity research and its practical impact on server infrastructure.

Note: This article details critical security vulnerabilities in server hardware. Readers should consult IT professionals for specific mitigation strategies relevant to their infrastructure.

Credibility flag: Technical, Actionable

Claimed Facts (10)

• This is a factual description of what BMCs are and where they are located.
• This statement provides technical details about the functionality of BMCs.
• This statement provides historical context for the security concerns surrounding BMCs.
• This states a specific finding by a named expert and lists affected vendors.
• This is a quantifiable result from a security scan.
• This provides a statistical outcome of the external scan.
• This provides a statistical outcome of the internal scan.
• This is a factual report of a past security incident.
• This references an official government agency's assessment of a vulnerability.
• This states the existence and name of a released tool.

Opinions (5)

• This is a subjective assessment of the level of attention given to BMC security.
• This is a critical judgment about the state of BMC security practices.
• While IPMI is a key factor, labeling it the 'chief culprit' is an interpretation of its role.
• Phrases like 'pervasive,' 'under-monitored,' and 'much more exploitable than many folks realize' indicate an opinionated assessment of the situation.
• The phrase 'not at liberty' implies a constraint that is an interpretation of the researcher's situation.

Claims (5)

• While the article details vulnerabilities, the claim of 'thousands of servers' being *currently* backdoored is a strong assertion that may be difficult to definitively prove without direct evidence of active exploitation on that scale.
• While vulnerabilities can persist, stating they are 'more than a decade old' without specific examples or proof of their continued existence in that state is a broad claim.
• This explanation of a technical flaw is highly specific and complex, making it difficult to verify without deep technical expertise and potentially prone to oversimplification or misinterpretation in a general article.
• The assertion of 'most significant' is subjective and lacks comparative data to definitively rank the bugs.
• The claim that 'small keyspaces' *make them recoverable* is a strong assertion that depends on the specific size of the keyspace and the computational resources available, which are not detailed.

Key Sources

• HD Moore — CEO and founder of security firm runZero
• Cybersecurity and Infrastructure Security Agency — Government Agency
• HPE — Server Manufacturer
• Supermicro — Server Manufacturer
• Avocent — Server Management Solutions Provider
• Huawei — Technology Company
• Lenovo — Technology Company
• Dell — Technology Company
• Intel — Technology Company
• H3C — Technology Company
• Nvidia — Technology Company
• AMI — BIOS and Firmware Provider