Exploiting Intel’s Management Engine

Re:Exploiting Intel’s Management Engine by elagost on Friday November 15, 2019 @01:16PM (#21547235)

This has been the case in Server systems for a while - IPMI[1] has been used for remote KVM, power management, remote mounting of ISOs, etc. on many servers for years. HP's iLO, Dell's iDRAC, and even SuperMicro boards have an implementation. This pattern is pretty standard, but none of it's FOSS.

[1]https://en.wikipedia.org/wiki/Intelligent_Platform_Managemen...

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by plausibilities on Friday November 15, 2019 @01:35PM (#21547415)

Wasn't NordVPN recently pwned via an IPMI security hole?

iLO is kind of a piece of crap, but I do love my Xen and resource pools

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by tyingq on Friday November 15, 2019 @01:41PM (#21547471)

Pretty sure the IPMI software is crap no matter the brand. I know the SuperMicro one requires a very old Java version fat client to interact with it, and is very flaky.

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by petschge on Friday November 15, 2019 @02:00PM (#21547641)

The newer versions finally support a HTML5 console instead of the old java webstart horror they used to ship with.

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by kelleyk on Friday November 15, 2019 @04:09PM (#21548793)

Also, if you need to interact with a Supermicro BMC that doesn't support the HTML5 console (for example, because it's running older firmware), I reverse-engineered the proprietary "iKVM" protocol (along with a lot of other parts of the BMC) and implemented support for it on a branch of noVNC, which you can find here: https://github.com/kelleyk/noVNC

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by dboreham on Friday November 15, 2019 @04:42PM (#21549088)

Waaaat! Praise be. Now I can justify the last 45min reading HN...

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by plausibilities on Sunday November 17, 2019 @01:37PM (#21559255)

Thank you for your contribution!

Keeping that "Just buy a shitload of cheap-o eBay 2U/4U hand-me-downs" workflow viable for years to come :D

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by phil21 on Friday November 15, 2019 @07:14PM (#21549980)

Indeed. We have used this in production for some time now!

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by gnufx on Sunday November 17, 2019 @11:44AM (#21558674)

Yes, but that stuff isn't actually IPMI. You normally only need it if need a graphical console (or haven't re-directed to the IPMI serial link), or need to mount a boot image, which is typically painfully slow. (FreeIPMI and associated tools like conman are good for IPMI management, with a set of workarounds for defective implementations.)

[ Parent | on HN ]

Re:Exploiting Intel’s Management Engine by gnufx on Sunday November 17, 2019 @11:35AM (#21558627)

OpenBMC is free software, used by POWER9 systems, in particular. I haven't used it, but I think it's in the Summit and Sierra supercomputers as well as TALOS systems. IPMI/BMC implementations are a nightmare, and something you can potentially fix has considerable appeal.

[ Parent | on HN ]