Status: private working repo. Raw per-host data committed intentionally
(see SANITIZE.md for the public-release scrub recipe — public repo will be
a separate fresh git init, NOT a filtered clone of this).
Between 2013 and 2026 the cipher-0 bypass (CVE-2013-4783, CVSS v2 10.0) was remediated fleet-wide — advertised ~47% of IPMI-2.0 (Moore 2013) → 27.6% of total (2026), exploitable-confirmed only 0.03% (13 hosts) — while same-era flaws of comparable CVSS severity (RAKP-2 HMAC harvest CVE-2013-4786, CVSS v3 7.5; default/shared credentials) stayed open, and BMC exposure shifted from the well-studied UDP/623 surface toward unauthenticated Redfish/HTTPS. (Asymmetry is in remediation, not disclosed severity.)
- Exploitable-confirmed cipher-0 (full RMCP+/RAKP-4 cycle) — prior studies we found counted only advertised cipher-0; this is, to our knowledge, the first exploitable-confirmed measure.
- Cross-protocol identity correlation — IPMI Get-System-GUID vs Redfish service-root UUID; 606 hosts independently cross-validated.
- SMBIOS-UUID byte-order MAC-OUI ground truth vs HTTP-fingerprint vendor labels; quantifies HTTP-fingerprint inaccuracy and ODM supply chain (Quanta-builds-Lenovo etc.).
- Quantified internet-exposed iLO4 cohort (first we are aware of) + /xmldata RIMP leak rate (97% of 2,260 leak serial/model/fw unauth).
- Firmware-confirmed fleet-shared credential with version-gated exposure
window (AMI MegaRAC
sysadmin:superuser, ≤12.61.17).
README.md this file (title/thesis/layout)
STATS.txt generated — `make` (population-framed corpus statistics)
TREND.md hand-authored — longitudinal 2013→2026 + 7 reviewer caveats
SANITIZE.md public-release scrub recipe (HARD RULE: fresh repo, not filter)
Makefile `make` regenerates STATS.txt; `make check` pins key numbers
src/gen_stats.py STATS.txt generator (pins cipher-0 to data/findings.md)
data/ raw per-host CSVs + findings.md (PRIVATE — see SANITIZE.md)
make # regenerate STATS.txt from data/
make check # assert cipher-0 numbers still match findings.md
- Prose: abstract, intro, methodology, results, discussion, conclusion
- Related work section (anchors: Bonkoski WOOT'13, Gasser TMA'16, Farmer/Moore 2013, Eclypsium BMC&C) — see TREND.md sources
- Ethics / responsible disclosure section (BLOCKER): scan justification, opt-out handling, disclosure timeline to HPE/AMI/Dell/Gigabyte/vendors, IRB stance
- Citations / bib (CVEs, IPMI 2.0 §13/§22, Redfish DSP0266 §13.2.2, RFC 4122, SMBIOS spec)
- Statistical framing: rates with CIs, selection-bias treatment
- Sanitized data-release package per SANITIZE.md (separate public repo)
- Honest limitations section (incl. the measurement corrections logged in ../tasks/lessons.md)