A perfect example of this was found recently by Dan Farmer. Farmer conducted a scan of UDP port 623 which is used by Baseboard Management Controllers to provide platform management (IPMI Intelligent Platform Management Interface) remotely. His scan yielded 230,000 BMCs that were accessible over the internet.

Now you might be wondering what Farmer would do this. Well it is because in 2013 HD More (founder of Metasploit) found that these BMCs could be easily hacked with a few simple commands due to flaws in the firmware. This is much like what we saw when it was found that many SCADA (supervisory control and data acquisition) devices were visible to the internet and using default admin passwords.

Farmer’s scan of BMCs found that roughly 90% of the 230,000 (207,000) were vulnerable to the exploit that Moore had disclosed a year ago. Some of the 207k vulnerable BMCs were running firmware that was 13 years old! These critical control interfaces should not be exposed to the internet in the first place, but to leave them running outdated and vulnerable firmware such as Famer found is insane.

So when you hear about that great new cloud service that just hit and are thinking about passing over your credit card information just ask yourself how they are getting low prices for their services and what corners they might be cutting.

Tell us what you think in our Forum