Linda and Doris rule the ‘net

Some misc ramblin’ notes/data on IPMI & SSL Certificates.

So I used the SSL observatory software (oddly written, but still cool) to scan for certificates on a bit over 300K systems suspected of running IPMI (which in turn were had from HD Moore of Rapid 7 – thanks HD!) and who were on the net.  In case anyone else was interested in using the SSL Observatory stuff, it’s pretty simple once you figure it out – here are my cliff notes (if nothing else it may save me from trying to figure it out again!)

Install with “git clone https://git.eff.org/public/observatory.git”.

In the “scan” subddir there’s an important file – FasterCertificateGrabber.py.  This is cool stuff – you can simply give it an IP addr:

Better still, however, is that it can use a filename stuffed with IP addresses, one per line – simply use the “-f” option.  On my mac, at least, it choked if the file was too big (like… say… 300K addrs ;)) because it ran out of file descriptors, so I simply chopped it up and put it all in a loop.  250 at a time seemed to work well, so I did something like:

And the observer software was off to the races, doing 250 scans in parallel at a time, pretty nifty. It saves the results in raw format in a series of subdirs (e.g. 1.x.x.x/1.x.x.1/1.1.1.1.results for the IP address 1.1.1.1.) There’s another program to slice and dice the results – the “openssl_dump.py” command. It simply takes a subdir and snuffles around for results files, so you can do this (from the main SSL Observatory directory; I redirected the output to a file to avoid drowning in output):

Inside is all the SSL glory; for instance:

And finally some modest analysis/thoughts on the results.

The CN is an interesting field. Cisco seems to put their OUI in some of theirs (e.g. Issuer: CN=68:ef:bd:d8:d0:a6, OU=RV016, O=Cisco-Linksys, LLC, C=US, L=Irvine, SN=California), maybe part of their install (as far as I can tell most network gear doesn’t use IPMI, this is probably their server stuff). Interestingly HP (with iLO2, it appears, although the strings seem like ILO3 as well at times) used to put a unique identifier on their cert – it looks like the serial # (e.g. Issuer: C=US, ST=Texas, L=Houston, O=Hewlett-Packard Company, OU=ISS, CN=ILOSGH039XERW). Other iLO 2 systems have an IP addr on them… maybe the internal one? Puzzling. Various others use Mac addrs & IP addresses. A few IMM’s (IBM’s offering, which I’m still seeking some sort of ID’er for.) Looks like old DRACs as well (Issuer: C=US, L=Round Rock, O=Dell Inc., OU=iDRAC Group, CN=iDRACdefault00221981F8E5)

In any case it’s pretty clear you can recognize BMCs by their SSL cert (if there was any doubt before.) At times it has uniquely identifying information.

My fav perhaps is “CN=GET A NEW CERTIFICATE!!/emailAddress=FOR TEST PURPOSES ONLY”

Of the 312,357 IPs, 112,982 listened on 443.

Key lengths?

3217 used DSA Public Keys.

So onto the Issuers – Linda and Doris appear to rule the ‘net! (1st & 3rd place.) Gotta like the “do not trust” notes that HP and some others put in. I was actually moderately surprised to not see any large company names – I guess no one really big puts their own stamp on things, at least not on the net, although this one was fun:

Issuer: C=–, ST=SomeState, L=SomeCity, O=SomeOrganization, OU=SomeOrganizationalUnit, CN=localhost.localdomain/emailAddress=root@localhost.localdomain

An 8K key!  They’re safe for now :)

Presumably some BMC manufacturer…. spot checked a few to see if I could discern any pattern, but they looked rather random.

The tail drops quickly. I tried to strip out the generics (verisign, thawte, etc.) Attaching the dup’d raw results – only a hair over 500 that had dups (e.g. > 1)

Dups in this case are strictly the issuer, it doesn’t say anything about the cert itself.

I stripped out the #’s 2-4, actually – they were all generic ones:

There may be other fields that could further highlight manufacturers, this is just on first glance. Certain getting the ilo and drac version #’s is easy enough.

I also took the keys and MD5’d them (just seemed easier to read than the rather long keys), sorted, uniq’d, etc.  These are different – matches here mean that systems have exactly the same SSL server key:

Almost the same as above (and some are identical) – but collects some more that are scattered due to unique things in the Issuer line.  A whole lotta people just don’t change or manage their certs.  Not that that is a surprise.

Here’s another look, based solely on the O= line in the Issuer:

A hell of a lot of HPs out there. Wonder if VS is a default for some BMC vendors?