Today we have news of a confirmed security vulnerability that impacts tens of millions of legacy Dell EMC servers. This vulnerability is known and is a broader industry-wide issue that impacts far more than Dell EMC iDRAC. We are calling this one iDRACula short for “integrated Dell Remote Access Controller unauthorized load access.” Earlier this week, a user on the STH forums posted that along with another individual, they were able to bypass the Dell EMC iDRAC firmware protections and load their own custom firmware onto the iDRAC baseboard management controller both via local access and via a remote access method. If exploited by a malicious party, iDRACula can allow a malicious actor to have complete remote administrative capability of a server.
In this article, we are going to talk a bit about the iDRACula vulnerability, and why it is a big deal. We are going to discuss the process we went through this week that led to this article. We are going to interview the STH forum member who was able to successfully use the vulnerability to load custom firmware on the Dell EMC iDRAC. Dell EMC quickly verified what has happened, and has put together mitigation steps along with providing a statement to STH for this article. Finally, we are going to discuss why this is a broader industry concern.
The TL;DR of iDRACula
Virtually every server today is shipped with an embedded computer that allows for remote administration. These embedded computers are referred to as baseboard management controllers or BMCs and are found in devices ranging from servers to networking devices and even server storage shelves. If you want to learn more about BMC’s and their functionality, we have a short piece: Explaining the Baseboard Management Controller or BMC in Servers.
Dell EMC PowerEdge servers are one of, if not the, most respected brands in the server industry. PowerEdge management uses their BMC and a software management solution called iDRAC (integrated Dell Remote Access Controller.) The iDRACula vulnerability involves replacing the signed iDRAC firmware with an altered firmware package, circumventing numerous protections that the Dell EMC team has in place for its older generations of servers. With advances in BMC hardware and Dell EMC’s security efforts, iDRACula is not a vulnerability on 14th Generation PowerEdge servers, using Intel Xeon Scalable processors.
While iDRACula is specific to Dell EMC PowerEdge products, and potentially some solutions built upon PowerEdge 13th generation and older servers, there is a broader discussion. Currently taking advantage of iDRACula requires a security policy lapse either by allowing physical access to a machine or remote access with a valid login credential. The broader discussion here is that Dell EMC is a leader in the industry for BMC security, so other server solutions are likely as if not more vulnerable to this type of activity. Vendors like Dell EMC, HPE, and even cloud players like Microsoft and Google are building silicon root of trust and signing apparatus to prevent firmware alternation like iDRACula going forward.
A Brief History of How We Got Here
Earlier this week, a STH forum member posted that they successfully replaced the iDRAC firmware with their own altered firmware. That post was taken down due to the sensitive nature of the topic, but the news was already out there.
Dell EMC learned of the STH forum post on Tuesday 25 September 2018 in the evening Pacific time, prior to its takedown. Although it was the evening, the company contacted the iDRACula poster and validated the methodology within 16 hours.
At that point, the company determined that it was a known vulnerability and a novel way to access the vulnerability. This is a family of vulnerabilities behind Dell EMC’s efforts to secure their platforms in new 14th generation PowerEdge servers using the new hardware features like a silicon root of trust. New PowerEdge servers may have hardware features to address this vulnerability, but there are millions of servers deployed today that will remain vulnerable without the new 14th generation PowerEdge hardware updates. As an editorial aside, it is a little hard to believe that state actors do not know of this type of vulnerability and have working methods for utilizing it.
Over the next few days, I stayed in contact with Dell EMC’s team and let them know that we would be running a story. I asked for a response after they had the opportunity to evaluate the severity and come up with a response plan.
I am not a security researcher. I will say that Dell EMC did a good job communicating with myself (knowing we would be running a story) and with the individual who took advantage of iDRACula. The server industry has seen a number of severe security issues this year, including the recent Intel L1TF / Foreshadow disclosure. Seeing Dell EMC’s security apparatus work quickly on this was welcome.
Over this week and several phone conversations, Dell EMC never asked me not to run this story, which I was slightly surprised about. If the company had asked, saying that this was too big of a security issue to go public, I would have obliged. Although this is undoubtedly a big story, we have a professional obligation in the industry to not chase page views on these sorts of stories if the company determines there is a clear and present threat to its users.
To get the editorial independence piece out of the way, as of this article, Dell EMC has never advertised with STH. Dell Technologies does cover some travel and press pass coverage for attending their shows such as Dell EMC World and VMworld for STH. Dell EMC also loans us servers for review such as the most recent Dell EMC PowerEdge R7415 Review. We do the most comprehensive server reviews. As of Q4, STH will review systems from virtually every server vendor on the Top 5 server vendors by revenue or units lists, including those who focus their distribution outside of the US. As an editorial policy, we do not allow vendors to see draft reviews or pieces like this before they go live. During the process, we asked Dell EMC for a comment for this article and they provided one.
Next, we are going to have an interview with one of the individuals that found iDRACula while trying to simply reduce the noise that their server made. We have Dell EMC’s response to the vulnerability. We will then discuss why this is a broader industry concern ending with some closing thoughts on the discussions you should be having within your IT team today to ensure you lower your risk profile.