Escalation of Privilege Advisory

Re:Escalation of Privilege Advisory by microwavecamera on Monday May 01, 2017 @06:30PM (#14242337)

I read about this a while ago. Apparently Intel's Management Technology which is built into like every Intel CPU now listens directly on the network interface so it can still send/receive data in case the OS is borked. It hooks in at ring 0. Like a rootkit the OS can't see.

[ Parent | on HN ]

Re:Escalation of Privilege Advisory by jsmthrowaway on Monday May 01, 2017 @08:05PM (#14242918)

It's common in the datacenter to come across motherboards with a switched eth0, with the BMC behind one leg and the user system behind another. You don't have to get that creative to get IPMI out of a machine when the OS is hosed -- to be honest, I think that is what you're actually thinking of, because "hook[ing] in on ring 0" is difficult to imagine working. You'd need driver awareness for when the management plane wants to transmit, at the least.

[ Parent | on HN ]

Re:Escalation of Privilege Advisory by djsumdog on Monday May 01, 2017 @08:54PM (#14243159)

It's not just Intel that does it. HP Storage solutions use iLO which is pretty much the same thing for SANs.

[ Parent | on HN ]

Re:Escalation of Privilege Advisory by jsmthrowaway on Monday May 01, 2017 @10:25PM (#14243526)

Not just SANs, pretty much their entire product line. iLO is a very common IPMI deployment at companies with HPe gear, which is a number of very large ones.

[ Parent | on HN ]