24,650 internet-accessible BMCs leak password-derived hashes before login

iilreb about 20 hours ago 3 commentsRead Article on lavahq.io

⚡ Community Insights

Discussion Sentiment

100% Positive

Analyzed from 78 words in the discussion.

Discussion (3 Comments)Read Original on HackerNews

londons_explore•about 15 hours ago

Who exactly wrote this spec?

How sure are we that it was an accident to share password hashes with the world?

adrian_b•about 12 hours ago

The great mistake is that those servers have a management Ethernet interface connected to the Internet.

The management Ethernet port of a server, on which it listens for the IPMI protocol, is supposed to be connected only to a dedicated internal management network, which must be separated from the Internet, and also from the normal internal networks.

It is not expected that IPMI is secure. Security is supposed to be achieved by physical separation.

londons_explore•about 3 hours ago

If that were true, it wouldn't have a password at all.