Tucked into the motherboard of almost every server you own sits a tiny computer with god-mode access, and most people forget it exists. Security researcher HD Moore reminded everyone at DEF CON 34 that this quiet little chip can hand an attacker the keys to your entire machine, no password required.
- Moore disclosed 123 confirmed vulnerabilities, packed into 35 draft advisories across eight vendors.
- Roughly 51,000 devices answered IPMI probes across the internet, and about half leaked a crackable password hash with zero authentication.
- The share of trivially exploitable controllers on internal networks jumped from around 12% to roughly one in three.
What a BMC Actually Does
A baseboard management controller, or BMC, is embedded hardware that lives on the server motherboard. It gives administrators remote power control, console access, and firmware updates that work even when the main operating system is off or broken. That independence is the whole point. You can reboot a frozen machine from across the country without walking into the data center.
IPMI is the protocol most people use to talk to these controllers. It’s old, it’s everywhere, and as Moore put it during his DEF CON session, these devices are basically a sanctioned backdoor to whatever real hardware you care about. Some of the exposed servers he found were sitting on a million dollars of GPU gear, reachable through a web login that asked for no password at all.
How These Ports End Up Naked on the Internet
The exposure usually comes down to a simple mistake. Many servers ship with a single physical network port shared between the host and the BMC. If the configuration resets or a checksum error trips, the BMC can grab its own address through DHCP on whatever subnet that port happens to be plugged into. Moore’s blunt summary was that someone messed up and DHCP’d the wrong NIC.
That’s how researchers keep stumbling onto tens of thousands of these controllers facing the open internet. Moore combined a full IPv4 scan with Shodan queries and got about 51,000 IPMI responses. Between 23,000 and 25,000 of them coughed up a password hash with no authentication needed. Internal networks were worse, since those networks were never built to be scanned from outside.
Moore has been watching this space since Dan Farmer’s 2013 work on IPMI password disclosure, and his takeaway this year was grim. The problem got worse, not better. Once someone slips in through the BMC, the server’s own defenses stop mattering entirely.
The Flaws Under the Hood
Several bugs start with no credentials and end with code running on the host itself. The research sorted them into a few recurring types. RAKP state-transition bugs let an attacker skip or reorder the IPMI 2.0 handshake and authenticate against leftover data in memory. Type confusion lets a session started in one mode reuse credentials meant for another. Supermicro added a hardcoded password to stop hash leaks, and that fix became its own bypass. Session relabeling can bump a low-privilege account up to administrator.
Moore singled out OpenBMC, the shared open-source firmware used by Supermicro’s newest generation, Nvidia BlueField, Intel, Google, and other hyperscalers. Because the code is shared, one authentication bug reaches every product built on it at once. In this case an attacker can set an invalid privilege level during the handshake, which makes the session fall back on a default key baked into the code instead of the real password.
Locking the Back Door
The good news is that network teams have real options. Put BMC traffic on its own VLAN so pre-authentication flaws can’t wander past one segment. Use a dedicated management NIC instead of sharing a port with the production server. Turn off KCS, the in-band channel, anywhere you don’t need it, since it hands anyone with host root a direct path to the controller. Set unique credentials on every single device, because shared and default passwords remain the fastest route to a leaked hash.
Where you can, favor Redfish over IPMI. Redfish is the newer management standard, and switching off IPMI removes a big chunk of attack surface. Just enforce that change at the network level, not only in the management interface, since a setting toggle alone is easy to miss.
Alongside the disclosure, runZero shipped OOBscan, an open-source tool that runs these bypass techniques automatically and flags vulnerable controllers. It’s a handy way to see what an attacker would see before one actually does. The chip you forgot about deserves the same attention as the server wrapped around it. Give it a look this week, because the people scanning for it already have.
