Beyond the OS: Forensic Analysis and Detection of BMC Redfish API Exploitation

Introduction

As security teams harden operating systems, hypervisors, and container runtimes, advanced threat actors are increasingly shifting their focus below the OS layer. Out-of-band management interfaces—specifically Baseboard Management Controllers (BMCs)—have emerged as prized targets for long-term persistence, covert surveillance, and catastrophic infrastructure disruption. For years, IPMI (Intelligent Platform Management Interface) was the de facto standard for remote server management. However, modern enterprise data centers and cloud providers have largely transitioned to the Redfish API, a RESTful management standard designed by the Distributed Management Task Force (DMTF).

While Redfish brings vastly improved flexibility, JSON payload formatting, and HTTPS-native communications over its legacy predecessors, it also exposes a rich, scriptable attack surface accessible directly via standard Web protocols. When compromised, a BMC grants an attacker unmonitored access to host memory, hardware configuration, persistent storage, and virtual media mounts—completely bypassing host-based Endpoint Detection and Response (EDR) agents and OS-level logging.

In this article, we examine the mechanics of Redfish API exploitation, detail a comprehensive digital forensics procedure for investigating compromised BMCs, and provide actionable defense strategies to protect out-of-band management infrastructure.

The Threat Surface: How Threat Actors Exploit Redfish APIs

The Redfish API represents hardware infrastructure as a hierarchical URI tree (e.g., /redfish/v1/Systems/1 or /redfish/v1/Managers/1). Because it handles actions via standard HTTP methods (GET, POST, PATCH, DELETE), attackers who gain network access to the out-of-band management network can orchestrate complex hardware manipulations using standard web tooling like curl or Python scripts.

Common Redfish Exploitation Vectors

• Credential Reuse and Default Account Abuse: Many deployments fail to change default vendor credentials (e.g., root/calvin, admin/admin) across administrative interfaces, or they rely on weak directory service integration.
• Session Hijacking and Token Reuse: Redfish utilizes HTTP header-based authentication tokens (X-Auth-Token). Attackers sniffing unencrypted management traffic or exploiting improper token expiration logic can hijack active administrative sessions.
• Rogue Virtual Media Mounting: Through the VirtualMedia endpoint (e.g., /redfish/v1/Managers/1/VirtualMedia/1), an attacker can remotely attach a malicious ISO image hosted on an external web server and configure the host server to boot from it upon the next restart.
• Malicious Firmware Persistence: By leveraging the UpdateService endpoint (/redfish/v1/UpdateService), threat actors can flash modified or backdoor-embedded BMC firmware images, achieving persistence that survives host re-imaging and drive wipes.
• Silent User Creation: Attackers frequently interact with /redfish/v1/AccountService/Accounts to create secondary administrative users with elevated privileges, creating persistent backdoors completely invisible to the host OS.

Forensic Investigation of a Compromised BMC

Investigating a potential BMC compromise presents unique forensic challenges. Standard host-based digital forensic and incident response (DFIR) tools cannot inspect BMC volatile memory or out-of-band event logs directly from the host operating system without specialized vendor utilities or low-level physical access.

Step 1: Volatile Data Collection and Session Audit

When responding to an incident involving suspected out-of-band access, start by querying the live Redfish interface to extract volatile administrative metadata before rebooting or power-cycling the BMC.

To audit currently active sessions and identifying tokens, issue a secure request to the SessionService endpoint:

curl -k -u "admin:password" -X GET https://<BMC_IP>/redfish/v1/SessionService/Sessions

Analyze the JSON response body to inspect session URIs, target IP addresses, and creation timestamps. Look specifically for anomalous source IP addresses or session durations that extend far beyond standard operational maintenance windows.

Step 2: Account Service and Privilege Enumeration

Inspect the list of registered user accounts on the BMC to detect rogue backdoors created by an adversary. Execute a query against the AccountService endpoint:

curl -k -u "admin:password" -X GET https://<BMC_IP>/redfish/v1/AccountService/Accounts

Iterate through each account URI (e.g., /redfish/v1/AccountService/Accounts/3) and audit the following attributes:

• RoleId: Verify if unauthorized users have been assigned Administrator or OemAccountAdmin roles.
• Enabled: Look for previously disabled accounts that were reactivated.
• Locked: Check whether failed login lockouts were administrative cleared.

Step 3: Event and System Log Extraction

The BMC maintains internal event logs independent of the host OS syslog. In Redfish, these are typically exposed under the LogService collection within the Manager or System resource. Collect the System Event Log (SEL) and Redfish Audit Log via:

curl -k -u "admin:password" -X GET https://<BMC_IP>/redfish/v1/Managers/1/LogServices/SEL/Entries

Forensic Tip: Threat actors often attempt to clear logs after completing their objectives using a POST request to /redfish/v1/Managers/1/LogServices/SEL/Actions/LogService.ResetLog. Always cross-reference the current log index sequence numbers. Gaps in entry IDs strongly suggest log sanitization efforts.

Step 4: Virtual Media and Boot Order Verification

To determine if the attacker attempted host takeover via remote ISO injection, inspect the state of the VirtualMedia service:

curl -k -u "admin:password" -X GET https://<BMC_IP>/redfish/v1/Managers/1/VirtualMedia/CD1

Focus on key fields such as Inserted (boolean), Image (the URL pointing to the remote payload ISO), and ConnectedVia (indicating whether the media was mounted via URI or applet session).

Deep-Dive Forensic Analysis: BMC Flash Extraction

If the API queries indicate that the BMC firmware itself may have been modified or backdoored, off-system forensic analysis of the SPI flash chip is required. Using specialized hardware tools like a bus pirate or dedicated programmer (e.g., flashrom), investigators can dump the raw SPI flash contents from the physical motherboard.

Once the binary firmware image (e.g., bmc_flash.bin) is acquired, unpack the SquashFS or JFFS2 file systems using tools such as Binwalk:

binwalk -e bmc_flash.bin

During filesystem extraction, focus forensic examination on:

1. /etc/passwd and /etc/shadow inside the BMC Linux filesystem to locate hardcoded hashes.
2. Startup scripts located in /etc/init.d/ or Systemd service files for unauthorized persistence hooks.
3. Modified SSH dropbear keys in /etc/dropbear/ or unauthorized public keys in /root/.ssh/authorized_keys.

Mitigation and Hardening Strategies

Securing out-of-band infrastructure against Redfish API exploitation requires a layered security posture bridging network architecture, identity management, and cryptographic integrity monitoring.

1. Strict Network Isolation

BMC management interfaces must never be exposed to the internet or primary corporate LANs. Enforce strict microsegmentation by isolating all Redfish API endpoints on a dedicated, non-routable Out-of-Band (OOB) VLAN. Access should be restricted exclusively through hardened jump boxes authenticated via multi-factor authentication (MFA).

2. Centralized Ingestion of Redfish Events

Configure the Redfish EventService (/redfish/v1/EventService) to push real-time event subscriptions via HTTPS webhooks directly to a central SIEM or SOAR platform. Configure alerts for high-risk Redfish events, including:

• Account creation or password modification events.
• Firmware update initialization attempts.
• Virtual Media mount requests.
• Configuration resets or factory restore commands.

3. Enforce Cryptographic Hardware Root of Trust

Deploy hardware platforms that implement vendor-signed cryptographic verification (such as OpenBMC with signed image verification or vendor equivalents like HPE iLO Silicon Root of Trust and Dell iDRAC Secure Boot). Ensure that downgrade protections are enabled to prevent attackers from installing legacy, vulnerable firmware versions.

Conclusion

As perimeter defenses continue to mature, the out-of-band management layer represented by BMCs and the Redfish API remains a critical target for sophisticated threat actors seeking invisible persistence. By understanding how Redfish APIs can be manipulated and embedding out-of-band event collection and flash memory analysis into digital forensics workflows, enterprise security teams can effectively detect, respond to, and neutralize hardware-level threats before catastrophic impact occurs.