OSFC 2019 - Common BMC vulnerabilities and how to avoid repeating them

This talk was held at 9elements Cyber Security's Open Source Firmware Conference in Silicon Valley.

Presenter: Rick Altherr
Abstract:
BMCs have a notorious past of critical vulnerabilities that allow complete takeover of the host system. Worse, the same types of vulnerabilities creep up in BMC firmware over and over again. This talk looks at these repeat offenders in depth to see what can be learned. A comprehensive threat model for BMCs will be presented along with methodologies, practices, and techniques that can be used to avoid these common security mistakes.