The Computer Inside Your Computer Is Running 2013 Code
Every enterprise server has a second computer soldered onto its motherboard. It runs its own OS, its own network stack, its own IP address. It can reboot the server, reinstall the OS, read the disks — and it keeps working when the server is off. Its entire job is to hold god-powers over the machine it lives inside.
It’s called a baseboard management controller — a BMC — and according to research HD Moore presented at Black Hat this week, roughly 75,000 of them on the public internet are still vulnerable to a hole from 2013.
Read that number again. CVE-2013-4786 lets an attacker crack the admin password of an IPMI 2.0 BMC offline. Thirteen years old — public since before the iPhone 5S shipped. Moore’s scans found 86,000+ BMCs exposed to the internet, over half with at least one critical vulnerability. Internally it’s worse: of 126,761 BMCs inside corporate networks, nearly a third were critically vulnerable. This isn’t an edge case. It’s the default state of the world’s server fleet.
The old hole is only half the story. Moore found more than a dozen new vulnerabilities across HPE, Supermicro, Dell, Lenovo, Huawei, and others. Session tokens generated from a clock. Memory corruption reachable before authentication. Secrets baked into public firmware that work as live credentials. He’s holding details until vendors patch — responsible — but the pattern is the story: IPMI 2.0 itself trusts the attacker’s packet headers to decide whether to authenticate and decrypt. You can’t patch architecture like that. You can only bolt things onto it and hope.
And it’s not theoretical. ILObleed, found in 2021, was a real implant that wiped hard drives on HPE servers. It survived OS reinstalls and disk swaps. It lived in the BMC — the one place nobody looks. The bug it exploited had been patched four years earlier. The patch just never got installed.
The counterargument I keep hearing: “BMCs are management interfaces. You’re not supposed to expose them to the internet.” Fine. Eighty-six thousand are exposed anyway, and the internal numbers prove the devices are brittle regardless. One foothold anywhere in your network — a phished laptop, a contractor’s VPN — and the BMC converts it into permanent, unkillable ownership of everything around it. “Don’t expose it” isn’t a security strategy. It’s a prayer.
The other counterargument: “vendors will patch.” They’ve had thirteen years on the headline bug. ILObleed is what happens when the patch exists and nobody deploys it — firmware updates need downtime and vendor tools, so they don’t happen. Meanwhile vendors keep shipping new bugs: buyers don’t demand firmware security in RFPs, so vendors don’t pay for it.
The fix list is embarrassingly short: long unique passwords, disable KCS, isolate the BMC network. Moore open-sourced OOBscan so admins can find their own holes. The data is free, the fixes are cheap, and “nobody told me” stopped being an excuse in 2013.
The computer inside your computer holds the master key to everything you own. Thirteen years is a long time to leave the same lock on the door — and the landlord still hasn’t changed it.
Sources: Ars Technica — Dan Goodin, CVE-2013-4786 (NVD), OOBscan (runZero)