24
Researchers disclose vulnerabilities in IP KVMs from four manufacturers (arstechnica.com)
submitted 7 months ago by to c/cybersecurity@sh.itjust.works
5 comments fedilink hide all child comments
 

Internet-exposed devices that give BIOS-level access? What could possibly go wrong?

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 7 months ago (2 children)

That just defeats the IP part of the KVM and in that case you'd better stick with a traditional KVM.

Your setup depends entirely on your threat model. In my case in a normal state everything on the network is locked. The KVM is never used for normal ops, only rebooting and entering a disk encryption key in case I'm remote and have a failure. The KVM can only be accessed through a VPN. That limits my threat exposure to be well below my threat model. If I was Edward Snowden this might not be enough, but last I checked I'm not hunted by any state actor, rogue or not, so making sure the KVM is not accessible from the internet is enough.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 7 months ago

    I’ve sold a half dozen small to midsize KVM systems. IP gives a lot of flexibility for deployment that “traditional” systems don’t, and can be done a lot cheaper as the switches can be much less than the “big iron” requirements for traditional systems.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 7 months ago

    That just defeats the IP part of the KVM and in that case you'd better stick with a traditional KVM.

    Video cables and USB cables were never designed for a 20m run. Most have difficulties beyond a 2-5m distance.

    My servers will be in my basement, at the other end of the house. My C&C machine will be in my office. The entire purpose of remote KVM is such that I don’t have to hoof it all the way down into the basement just to do something quick. Or go back-and-forth if there is something in my office I have to reference while doing the work.

    In fact, I suspect that network KVM is exceedingly useful for anyone whose machines are more than five steps away. Even across the room makes a hell of a lot of sense.

  • permalink
  • fedilink
  • source
  • parent