Let's say you have a server at a data centre, but a hacker manages to find a way in and has access to your server. What are the attack possibilities with all the interfaces available?

Are there any known attack and defence mechanisms to a system once physical access has been gained?

Think about VGA, USB, Firewire, IPME and BMCs.

Running Ubuntu 16.04.

--- Edit ---

The question is a bit broad, however, I am hoping for practical answers, such as:

PCIleech: https://github.com/ufrisk/pcileech

The answer provided is not exactly what I am looking for, since the top answer is: "The attacker can do everything". I am hoping for more in-depth (practical) answers of the possibilities are of 'everything'.

  • If you are looking for a list of all possibilities, that makes this even more too broad. The point is that you have lost all control so there is nothing you can do to stop any one particular attack. So knowing a list of things is meaningless. – schroeder May 15 '18 at 12:42
  • 1
    OP, in general you can protect in software from attacks from a variety of interfaces, with the exception of JTAG. If an attacker has access to the JTAG header or traces, they will be able to have a higher level of access than even any software can get (they will be able to halt the process or and examine or modify register states, memory, etc. They will be able to step the processor one instruction at a time and monitor the pipeline states, etc). – forest May 15 '18 at 13:36
  • 1
    Well, for that device, there’s USBGuard that can blacklist USB VID/PID sets. But if you’re in America, you’ve got some very liberal defense-of-property laws. You can check with an intelligent cop (schroeder) if you’re legally allowed to boobytrap your server room. Texas? Probably! Regardless, you want an off-grid alarm system (not GSM based, no PIR - use radar (google doppler motion sensors)) and sensors in your cage and server case. – user2497 May 15 '18 at 13:43
  • 2
    @user2497 For what device, JTAG? You can't block JTAG using software. And why do you think schroeder is a cop anyway? Also no, you cannot boobytrap your room in any state in America (assuming the boobytrap causes injury) due to the Fireman's rule. – forest May 15 '18 at 13:47
  • 1
    @user2497 USB is a unidirectional multicast though, so you could not sniff keyboard data. All you could sniff is data going from the computer to the keyboard, and who cares about sniffing caps light status controls? Master to slave can be sniffed, slave to master cannot. Also, you are right that police are pretty much useless for solving "cyber" crime. I agree with you there. – forest May 15 '18 at 23:18

Companies like Amazon (AWS), Microsoft (Azure) etc are all ISO XXX compliant, have strict security rules (I guess). Now neither you nor they can prevent a malicious employee who has access to the data center to harm/hack the hardware. But it can be detected...

One way I can think of defence is to encrypt the disk at rest.

The rest is in the hands of the attacker.

  • This really isn't an answer. The scenario is that an attacker gets physical access (not the likelihood of this happening), which makes your first paragraph moot. "The rest is in the hands of the attacker." is an anti-answer. The whole point of the question is to ask what can be done. – schroeder May 15 '18 at 11:59
  • 2
    By the way, I have walked the data center floor of an Amazon data center. ISO XXX certification is meaningless when I can pop a USB stick in a device in one of the cages, and no, it cannot be detected. – schroeder May 15 '18 at 12:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.