An alarming number of servers containing motherboards manufactured by Supermicro continue to expose administrator passwords despite the release of an update that patches the critical vulnerability, an advisory published Thursday warned. The threat resides in the baseboard management controller (BMC), a motherboard component that allows administrators to monitor the physical status of large fleets of servers, including their temperatures, disk and memory performance, and fan speeds. Unpatched BMCs in Supermicro motherboards contain a binary file that stores remote login passwords in clear text. Vulnerable systems can be detected by performing an Internet scan on port 49152. A recent query on the Shodan search engine indicated there are 31,964 machines still vulnerable, a number that may not include many virtual machines used in shared hosting environments. “This means at the point of this writing, there are 31,964 systems that have their passwords available on the open market,” wrote Zachary Wikholm, a senior security engineer with the Carinet Security Incident Response Team. “It gets a bit scarier when you review some of the password statistics. Out of those passwords, 3,296 are the default combination. Since I’m not comfortable providing too much password information, I will just say that there exists a subset of this data that either contains or just was ‘password.'” Read 5 remaining paragraphs | Comments
Visit site:
At least 32,000 servers broadcast admin passwords in the clear, advisory warns
harrymcc (1641347) writes “In June 1967, a weekly newspaper called Computerworld launched. Almost exactly 47 years later, it’s calling it quits in print form to focus on its website and other digital editions. The move isn’t the least bit surprising, but it’s also the end of an era–and I can’ t think of any computing publication which had a longer run. Over at Technologizer, I shared some thoughts on what Computerworld meant to the world, to its publisher, IDG, and to me.” Read more of this story at Slashdot. 
