It's good that you posted this, unfortunately most people remain blissfully unaware of this information despite this paper dating from 20...
It's good that you posted this, unfortunately most people remain blissfully unaware of this information despite this paper dating from 2013 and other public discussions also having taken place. Dan Farmer, the author, wrote the original SATAN host security scanner. I had some emails with Dan about IPMI circa 2013. His paper is a good restatement of many of the problems of IPMI. However, in my mind the biggest problem with IPMI, which is not really well elucidated in this paper, is that it turns every machine in to two machines, and compromising either one means you can automatically compromise the other: ie. own the host, own the BMC by flashing it with vendor tools. Own the BMC, own the host by any number of ways including memory manipulation, old-school keyboard input, presenting fake devices to the running kernel, etc. Unfortunately, it's therefore impossible to ever be completely sure you've got control of a system. In the face of any suspected attack you cannot ever regain control with any confidence whatsoever, even by flashing firmware.
Posted by contingencies on May 28, 2015, 3:20 AM
Tags
Related issues
- I mean that's the problem though.
- I've always believed the opposite: get conditionals deep in your code so that the higher level control flow is regular.
- The biggest problem with AI isn't being able to do things.
- I am a 3D printing maker type nerd (I make my own tools for other creative tasks, rather than as their own outcomes) and I saw an incredi...
- Of course not, those are clearly scams.
- Claude makes more detailed plans that seem better if you just skim them, but when analyzed, has a lot of errors, usually.
Raise real-world problems, find people facing the same issue, and discuss solutions.6,500 issues0 comments
hackernews (EdTech)
I mean that's the problem though.
I've always believed the opposite: get conditionals deep in your code so that the higher level control flow is regular.
The biggest problem with AI isn't being able to do things.
I am a 3D printing maker type nerd (I make my own tools for other creative tasks, rather than as their own outcomes) and I saw an incredi...
Of course not, those are clearly scams.
Claude makes more detailed plans that seem better if you just skim them, but when analyzed, has a lot of errors, usually.
Effectively everyone is building the same tools with zero quantitative benchmarks or evidence behind the why / ideas … this entire s...
> creating and operating a small company in Germany is a nightmare To be fair, I think the problem operating in Germany is its federated...
It's good that you posted this, unfortunately most people remain blissfully unaware of this information despite this paper dating from 20...
It's good that you posted this, unfortunately most people remain blissfully unaware of this information despite this paper dating from 2013 and other public discussions also having taken place. Dan Farmer, the author, wrote the original SATAN host security scanner. I had some emails with Dan about IPMI circa 2013. His paper is a good restatement of many of the problems of IPMI. However, in my mind the biggest problem with IPMI, which is not really well elucidated in this paper, is that it turns every machine in to two machines, and compromising either one means you can automatically compromise the other: ie. own the host, own the BMC by flashing it with vendor tools. Own the BMC, own the host by any number of ways including memory manipulation, old-school keyboard input, presenting fake devices to the running kernel, etc. Unfortunately, it's therefore impossible to ever be completely sure you've got control of a system. In the face of any suspected attack you cannot ever regain control with any confidence whatsoever, even by flashing firmware.
Comments (0)
No comments yet. Start the discussion.