<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 5/31/2018 8:15 AM,
<a class="moz-txt-link-abbreviated" href="mailto:openbmc-request@lists.ozlabs.org">openbmc-request@lists.ozlabs.org</a> wrote:<br>
</div>
<blockquote type="cite"
cite="mid:mailman.378.1527772501.18429.openbmc@lists.ozlabs.org">
<pre wrap="">Message: 1
Date: Thu, 31 May 2018 18:38:23 +1000
From: Stewart Smith <a class="moz-txt-link-rfc2396E" href="mailto:stewart@linux.ibm.com" moz-do-not-send="true"><stewart@linux.ibm.com></a>
To: Nancy Yuen <a class="moz-txt-link-rfc2396E" href="mailto:yuenn@google.com" moz-do-not-send="true"><yuenn@google.com></a>, OpenBMC Maillist
<a class="moz-txt-link-rfc2396E" href="mailto:openbmc@lists.ozlabs.org" moz-do-not-send="true"><openbmc@lists.ozlabs.org></a>
Subject: Re: OpenBMC Security Working Group Kick Off
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:87efhs43uo.fsf@linux.vnet.ibm.com" moz-do-not-send="true"><87efhs43uo.fsf@linux.vnet.ibm.com></a>
Content-Type: text/plain
Nancy Yuen <a class="moz-txt-link-rfc2396E" href="mailto:yuenn@google.com" moz-do-not-send="true"><yuenn@google.com></a> writes:
</pre>
<blockquote type="cite" style="color: #000000;">
<pre wrap="">The OpenBMC Security Work Group kick off meeting is scheduled for Thurs May
31, 9AM PDT. This first meeting is by invite only. Please email me if you
are interested in participating in this working group.
</pre>
</blockquote>
<pre wrap="">Would topics like "security of the BMC from a hostile host" be part of
this?
A design of OpenPOWER systems is that the BMC and the Host don't have to
trust each other, and this should extend to a host that's hostile
towards the BMC.
</pre>
</blockquote>
<p>Yes! The BMC security boundary ends at the pins that connect to
the host, so that is treated an attack surface. I may have been a
bit fuzzy on this when I sketched out the initial security
docs...so I'll update the OpenBMC security docs to talk about
risks from host ipmi and mbox and explain the security risks, then
grab an expert to explore further.<br>
</p>
- Joseph<br>
<blockquote type="cite"
cite="mid:mailman.378.1527772501.18429.openbmc@lists.ozlabs.org">
<pre wrap="">
I'd be surprised if we didn't find bugs in both mboxd and host ipmi if
we started fuzzing those interfaces.
<div class="moz-txt-sig">--
Stewart Smith
OPAL Architect, IBM.</div></pre>
</blockquote>
<br>
</body>
</html>