0

I have an HP Proliant server. I have been using it for several years. Sometimes I used its iLO web interface via WAN (I have forwared required ports) completely ignoring all warnings from my browser about the server certificate being invalid. Recently I have learned many information about SSL/TLS and MITM attacks. Now I am VERY concerned about security issues. What if a bad guy in the middle learned my iLO credentials? What if he has already installed an undetectable malware? What if he modified iLO firmware so his activity is not displayed in iLO event log? What if he hacked the firmware so erasing and resetting everything won't help?

What should I do? Should I fear anything I have listed here? Should I change iLO password? Should I reset hard drives (currently there is no any valuable information stored on the server, so I can do it if it needed)? Should I do a Secure Erase? Should I reset iLO to factory defaults?

2
  • Just saw this in the news: New iLOBleed Rootkit Targeting HP Enterprise Servers with Data Wiping Attacks
    – Kate
    Dec 30, 2021 at 22:40
  • @Anonymous, I have already made iLO inaccessible from WAN and done everything you all recommended me (changing password, properly installing a certificate, checking logs and etc.). Thanks for advice! Is there any way I can ensure my system is not infected by this malware? I see it can clear logs to prevent administrators noticing malicious actions. Jan 1 at 7:48

3 Answers 3

1

You should definitely check the validity of the server certificate. If it is not the cert you were expecting then yes, an attacker could potentially have compromised everything on that server and used it to pivot further attacks.

The recommendation here for a compromised server is always the same: wipe it and rebuild.*

You may not need to do that, however that would be your call based on what you have on it, what data you value, your risk model etc.


* if you have the capability for forensic investigation and you think it will be worthwhile trying to understand how an attack was carried out, then take an image of the machine before wiping, however it is costly, and may not tell you anything

0

What if a bad guy in the middle learned my iLO credentials?

then you are screwed. You should regularly change the password on iLO.

What if he has already installed an undetectable malware?

then you are screwed. However I'm not sure if you can install a malware on iLO.

What should I do?

  1. change the password on iLO.
  2. use HP guide to install the certificate you trust (either from commercial provider, or internal enterprise CA). Do not use self-signed.
  3. optionally, set up firewall to allow access to iLO from known networks (if there are such). I would restrict direct access to iLO from internet. Instead, you should do secure VPN connection (from home, for example) to corporate network and then access iLO from internal network.
  4. make sure you do not ignore certificate errors automatically.

Should I reset hard drives (currently there is no any valuable information stored on the server, so I can do it if it needed)?

I wouldn't say it is necessary. AFAIK, iLO does not provide writable access to host storage.

Should I reset iLO to factory defaults?

if there is an evidence that iLO is compromised, then yes, you should do factory reset.

0

Sometimes I used its iLO web interface via WAN (I have forwared required ports)

Then it means your service is exposed to the whole Internet, unless you have some firewall rules that restrict access to a few whitelisted IP addresses. I would instead recommend that you use a VPN to connect to your corporate network. Do not expose sensitive services to the public Internet when there are alternatives.

What if a bad guy in the middle learned my iLO credentials?

Then you have a bigger problem than just a potentially compromised ILO. If your Internet connection has been compromised and you have a MITM on your network, then the potential damage goes well beyond the ILO and you need to consider the bigger picture.

What if he hacked the firmware so erasing and resetting everything won't help?

I don't know if that is even possible or technically doable. If in doubt you can reset reset the firmware and configuration, and change passwords, and install a proper certificate. Check the logs too. But there is no reason to panic unless there are indicators of compromise.

1
  • First of all I need to say that this is just my home server. Currently there is no any valuable information stored there, so I don't think I am interesting to any attacker. I have learned about MITM attacks just from a random article. Event logs seem to be OK, but I am still a bit concerned about firmware integrity. What if they are OK just because a bad guy modified the firmware so it does not display anything bad? What if he modified it so the "reset to factory defaults" button does not do reset the device fully? Dec 28, 2021 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.