Hacker News

points by NovemberPapa 1 day ago | 0 comments

How exploitable is this really? First, the machine has to do a PXE boot. In almost EVERY machine I have set up, it boots from fixed media first. Second, you have for force a machine reboot, and the machine has to be on a network you can reach.

Sure, there are lots of machines that PXE boot, but if it's on a public facing machine, why would you even configure it to PXE boot?

[–] p_l 1 day ago

Arguably it's trivial to fix for most netbooting environments, the one iffy case would be corporate laptops configured to boot from net for management purposes because there "attacker controls the network and timing" suddenly can become easy

[–] cestith 1 day ago

It's ICMP, so any network that doesn't filter ICMP and would allow malformed packets through could be a target. You'd have no idea when something was PXE booting, so you'd have to keep sending the packets and wait.

A bigger question I think is why you'd assign a public IP to a machine for PXE boot rather than booting it from a private IP space then assigning any publics once the OS is booted.