Thousands of servers can be remotely hacked

Security researchers have found that at least 47,000 Supermicro servers in 90 countries have unpatched vulnerabilities in the firmware for the control board controllers (Cube) and this could leave them open to remote attacks.

Security firm Eclypsium found the vulnerability and reported it to Supermicro and the company has since released a patch to fix the problem. However, if left unpatched, these vulnerabilities could be exploited to allow an attacker to connect to a server and virtually connect any USB device over the internet.

attack called USBAnywhere, can be carried out in relation to any vulnerable BMC intruders after gaining access to the corporate network. This means that the number of vulnerable servers could be much higher than the 47,000 that are affected by the internet.

  • Researchers compromise bare cloud servers
  • This is the best small business server of 2019
  • Security flaws found in many major kernel drivers

The cube is designed to allow administrators to perform out-of-band server management, which is why the vulnerability found by Eclypsium is so serious.

USBAnywhere

The USBAnywhere vulnerability has raised several issues: how Supermicro's X9, X10 and X11 cube platforms implement a virtual environment that gives administrators the ability to remotely mount a disk image as a virtual USB CD or floppy disk. Eclypsium researchers found that when remotely accessed, Virtual Media Services allows clear text authentication, sends large traffic without encryption, uses a weak encryption algorithm, and is susceptible to authentication bypass.

Potential attackers can use these questions to gain access to the server by capturing a legitimate user's authentication packet using default credentials or no authority at all in some cases. Once a connection has been established, the Virtual Media Service allows an attacker to communicate with the host system as if they had a directly connected USB device to it. From here, an attacker can load a new image operating system, use the keyboard and mouse to change the server, implant malware, or even shut down the server entirely.

Might be interesting:  Secrets to increasing your Steam profile level: What is it and why to increase it

It is generally recommended that organizations isolate the cube on their own and secured network segment. However, Eclypsium found that many organizations forget or ignore this step and the firm used a Shodan scan that showed at least 92,000 cubes are easily found online to illustrate this.

To avoid falling victim to such an attack, Eclypsium recommends that all organizations update their beech with the latest firmware and that they are not exposing them directly to the network as new BMC vulnerabilities are discovered at a rapid pace.

  • We've also highlighted the best antivirus programs of 2019

Through Computer Weekly

Please appreciate the article
Translate »