Rick Altherr

In this episode, Brian, Jess, and Steve introduce Rick Altherr, an expert in firmware security. Rick discusses a significant vulnerability he found in Supermicro BMCs known as 'USBAnywhere.' Originating from a curiosity about the mounting of ISO images on servers over the internet, Rick’s research uncovered that Supermicro implemented this feature in a dangerous manner. He illustrates the implications of his findings, including the staggering number of affected BMCs accessible on the internet (47,000), highlighting the critical nature of BMC security.

The conversation shifts to the ecosystem around Baseboard Management Controllers (BMCs) and their inherent vulnerabilities. Rick explains that many BMCs still operate on outdated standards like IPMI version two, which include weak security protocols and default passwords. The group discusses how this lack of security awareness leads to systems being exposed, underscoring the need for companies to be more vigilant about the security of their infrastructure.

Rick dives into the reverse engineering process he undertook to identify the USBAnywhere vulnerability. He outlines his methodology, tools like Wireshark and Ghidra, and the challenges he faced. The discussion emphasizes the technical intricacies of analyzing firmware and the importance of understanding the communication protocols in use. Listeners gain insights into the level of expertise required to navigate the firmware landscape successfully.

The dialogue transitions into a nostalgic discussion about Rick's favorite computers, including the Cray-1 supercomputer and AlphaStations. The group reflects on the aesthetic and design of old machines, blending personal stories with technical history. This segment highlights the passion that many in the tech community have for vintage hardware, sparking an intriguing conversation about the evolution of computing technology.

The podcast concludes with a forward-looking discussion about the future of firmware, particularly the rise of open-source initiatives like OpenBMC and Coreboot. Rick shares the need for security improvements within the firmware landscape and how open-source projects can aid this evolution. The conversation reflects an optimistic view of how collaborative efforts can potentially drive better security practices in the industry.