Threats Associated with Using IPMI in Publicly Accessible Networks and the Necessity of Regular Updates - IPMI Best Practices

Threats Associated with Using IPMI in Publicly Accessible Networks and the Necessity of Regular Updates

In the era of digitization, remote server management has become not only a convenience but a necessity. The Intelligent Platform Management Interface (IPMI) is one of the tools that facilitates the administration of server hardware from anywhere in the world. However, like any powerful tool, it carries risks, especially when exposed to public IP addresses.

Threats Associated with Exposing IPMI Interfaces to Public IP Addresses

1. Brute Force Attacks and Remote Takeover: Exposing IPMI to a public IP address makes servers vulnerable to brute force attacks, where hackers try hundreds of thousands of login and password combinations until they find the correct one. If the login credentials are weak, the server can be taken over.
2. Exploitation of Known Vulnerabilities: Publicly accessible IPMI becomes an easy target for attackers who regularly scan networks for known vulnerabilities. Examples include the security flaws CVE-2019-16649 and CVE-2019-16650, which affected specific IPMI software, allowing for privilege escalation and unauthorized system access.
3. Denial of Service (DoS): Attackers can carry out DoS attacks on IPMI interfaces, leading to system overload and denying access to authorized users. Such attacks can effectively disable remote hardware management at critical moments.

CVE Cases: CVE-2019-16649 and CVE-2019-16650

• CVE-2019-16649: This vulnerability allows a remote attacker to gain unauthorized access to the IPMI system through malicious packets. Attackers can exploit this flaw to bypass authentication mechanisms and gain access to administrative functions.
• CVE-2019-16650: This flaw enables privilege escalation, meaning an attacker with limited system access can gain full administrator rights. This allows full control over the server, including remote shutdown, restart, or configuration changes.

The Necessity of Regular Updates

Attacks on IT systems evolve daily, and hackers constantly seek new ways to breach security. Therefore, it is crucial that IPMI systems are regularly updated. Software manufacturers often release updates containing security patches that fix detected vulnerabilities.

• Proactive Update Management: Server owners should regularly monitor manufacturer websites and CVE databases (Common Vulnerabilities and Exposures) to stay informed about the latest threats and available patches.
• Network Segmentation: To minimize risk, network segmentation and isolating management interfaces from the public Internet is recommended. Access to IPMI should only be possible from trusted internal networks or through secure VPNs.
• Strong Authentication Mechanisms: Implementing strong passwords and additional authentication mechanisms, such as two-factor authentication (2FA), significantly complicates potential attackers' attempts to gain control over the system.

Using Extended IPMI Licenses

Purchasing and using extended IPMI licenses is a good practice for any administrator. These not only facilitate work but also add new capabilities, such as:

• Ability to update BIOS from the IPMI level
• Enhancements related to remote console access, e.g., HTML5 allowing virtual disk mounting
• RAID controller management
• Power consumption monitoring
• Additional Security Features
• Enhanced Logging and Reporting
• Custom Alerts and Notifications

Supermicro Provides Licenses Extending IPMI Capabilities

(1) All features listed are for validated components only. Exceptions may apply.

(2) Service Call Feature for SSM and SUM requires separate add-on license.