Possible MITM attack on remote server administration

Question

I have an HP Proliant server. I have been using it for several years. Sometimes I used its iLO web interface via WAN (I have forwared required ports) completely ignoring all warnings from my browser about the server certificate being invalid. Recently I have learned many information about SSL/TLS and MITM attacks. Now I am VERY concerned about security issues. What if a bad guy in the middle learned my iLO credentials? What if he has already installed an undetectable malware? What if he modified iLO firmware so his activity is not displayed in iLO event log? What if he hacked the firmware so erasing and resetting everything won't help?

What should I do? Should I fear anything I have listed here? Should I change iLO password? Should I reset hard drives (currently there is no any valuable information stored on the server, so I can do it if it needed)? Should I do a Secure Erase? Should I reset iLO to factory defaults?

Answer 1

You should definitely check the validity of the server certificate. If it is not the cert you were expecting then yes, an attacker could potentially have compromised everything on that server and used it to pivot further attacks.

The recommendation here for a compromised server is always the same: wipe it and rebuild.^*

You may not need to do that, however that would be your call based on what you have on it, what data you value, your risk model etc.

---

^* if you have the capability for forensic investigation and you think it will be worthwhile trying to understand how an attack was carried out, then take an image of the machine before wiping, however it is costly, and may not tell you anything

Answer 2

What if a bad guy in the middle learned my iLO credentials?

then you are screwed. You should regularly change the password on iLO.

What if he has already installed an undetectable malware?

then you are screwed. However I'm not sure if you can install a malware on iLO.

What should I do?

1. change the password on iLO.
2. use HP guide to install the certificate you trust (either from commercial provider, or internal enterprise CA). Do not use self-signed.
3. optionally, set up firewall to allow access to iLO from known networks (if there are such). I would restrict direct access to iLO from internet. Instead, you should do secure VPN connection (from home, for example) to corporate network and then access iLO from internal network.
4. make sure you do not ignore certificate errors automatically.

Should I reset hard drives (currently there is no any valuable information stored on the server, so I can do it if it needed)?

I wouldn't say it is necessary. AFAIK, iLO does not provide writable access to host storage.

Should I reset iLO to factory defaults?

if there is an evidence that iLO is compromised, then yes, you should do factory reset.

Answer 3

Sometimes I used its iLO web interface via WAN (I have forwared required ports)

Then it means your service is exposed to the whole Internet, unless you have some firewall rules that restrict access to a few whitelisted IP addresses. I would instead recommend that you use a VPN to connect to your corporate network. Do not expose sensitive services to the public Internet when there are alternatives.

What if a bad guy in the middle learned my iLO credentials?

Then you have a bigger problem than just a potentially compromised ILO. If your Internet connection has been compromised and you have a MITM on your network, then the potential damage goes well beyond the ILO and you need to consider the bigger picture.

What if he hacked the firmware so erasing and resetting everything won't help?

I don't know if that is even possible or technically doable. If in doubt you can reset reset the firmware and configuration, and change passwords, and install a proper certificate. Check the logs too. But there is no reason to panic unless there are indicators of compromise.