zlacker

>>zdw+(OP)
"If a potential attacker already has administrative access to the BMC..."

Then you've already lost.

The BMC needs to be ideally on a physically isolated network, or at least a separate one that has no route from the outside nor on the machine itself.

>>SoftTa+K5b
> rent a server

> infect it with unremovable backdoor

> stop paying server so company rents server to somebody else

> ????

> profit!