Keyboard shortcuts are available for common actions and site navigation.
You can add location information to your Tweets, such as your city or precise location, from the web and via third-party applications. You always have the option to delete your Tweet location history. Learn more
HP iLO4 authentication bypass: curl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA" No, that's not a crash PoC. That's a full blown auth bypass. sscanf into fixed buffer overwrites a flag field that bypasses auth. Yes, really. https://airbus-seclab.github.io/ilo/SSTIC2018-Slides-EN-Backdooring_your_server_through_its_BMC_the_HPE_iLO4_case-perigaud-gazet-czarny.pdf …
Nobody audits anything. Everything is insecure. *sscanf*. *s-fucking-scanf*. In a web server. I'm just going to start giving each device a /30 and sticking reverse proxies in front of everything. Let me guess: next the switch will have an IGMP code exec bug or something. Sigh.
Not to mention that BIOS updates are not free anymore from HP, no service contract, no updates
This and other such nonsense. Guess why the last two servers I got to spec out were Lenovos, not HPs? Are you listening, @HPE?
It’s OK, latest HP server use Intel AMT. I guess it was cheaper than the iLO HW and SW. I swore no more HP for me anymore
Hmm? Just updated my iLO4 in an (old) Gen8 to 2.60 and that fixed it. This download and the SystemPAQ (against Meltdown and Spectre) were free w/o service agreement or license...
They started doing this shit with Gen9. And of the two servers we bought, we couldn't even register one because our reseller had apparently registered its serial themselves in exclusive mode. Never buying HP servers again until they stop this nonsense.pic.twitter.com/LD1Xz26p4v
Hm. With the System BIOS it said the same too (Entitlement required). But could d/l it anyway... But it's true: The iLO4 2.60 was free for Gen8.pic.twitter.com/q5dCyxz301
Yeah, iLO firmware is still free (and server independent; there is only one iLO4, it doesn't matter what server you have, the firmware is the same), but the BIOS updates are not.
Current BIOSes for most servers are also free, due to Spectre microcode updates.
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
*** glibc detected *** /usr/local/bin/marcan: malloc(): memory corruption: 0x00007f97d0004a40 ***
AAAAAAAAAAAAAAHHHHHHHHHHHHHH
You know @infinite_scream, don't you?
AAAHHHHHHHH
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHH!!!!
AAAAAAAAAAAAAAAAAAAAAHHHHHHHHHHHHHHH
WAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH
"Look, if he died while coding the backdoor into the firmware, he wouldn't bother to type 'AAAAAAAAAAAAAAAAA', he'd just say it."
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
