Provenance Record

Clean News-format piece (Overview / What We Know / What We Don't Know / Recommended Mitigations). 611 words, within the News category range (400-1200). Neutral, non-sensational tone throughout; hedged appropriately ('There is evidence the exposure is already being exploited', 'Neither outlet reported how many...'). No AI self-reference.

Both cited sources were fetched successfully by chief:review and I read the full decompressed HTML snapshots from disk (never re-fetched live) after verifying each file's sha256 against manifest.json at sources/2026-07/over-24650-internet-exposed-server-bmcs-leak-password-hashes-via-20-year-old-ipmi-flaw/: source-0.html.gz (bleepingcomputer.com, sha256 b3721680... matched, fetched via Archive.org fallback since the live URL apparently triggered a bot-block despite returning HTTP 200 -- the archived capture is dated 28 Jul 2026, same day as the article's own July 28, 2026 08:10 AM byline, so it is the correct, current version of the piece) and source-1.html.gz (thehackernews.com, sha256 381741da... matched, direct fetch, HTTP 200, no archive fallback needed). I converted both to plain text (custom HTML-stripping script) and did a full close read, plus targeted grep verification directly against the raw HTML for the specific figures called out in the review brief. source-0 (BleepingComputer, Bill Toulas, 'Over 24,000 exposed server BMCs leak password hash via decades-old flaw', July 28 2026) CONFIRMED: 36,872 internet-exposed IPMI hosts scanned, of which 24,650 exposed password-derived authentication material ('Of those, 24,650 exposed password-derived authentication material that could be used to perform offline password-cracking attacks'); CVE-2013-4786 named as the underlying flaw; 6,240 hosts accepted empty usernames with weak passwords; 2,340 instances used weak admin passwords matching public dictionaries; United States tops the exposure map at 39%; Supermicro factory-default 10-character uppercase password on chassis label with username 'ADMIN'; HPE factory password recoverable in about 1 day per captured response on an Apple M3 (verbatim-level match); an internet-exposed HPE iLO 4 login page displaying a ransom note demanding 0.3 BTC (confirmed via direct grep on the raw HTML, in addition to the extracted text); Supermicro's and HPE's differing vendor responses (Supermicro acknowledged the risk and will review default password policy; HPE gave only a standard auto-response with no security-team follow-up); the recommended mitigations list. NOT CONFIRMED in this snapshot: a Supermicro '~1 hour' GPU crack time, or an HPE '~1 minute' GPU crack time -- see finding below. The snapshot attributes the research to a company called 'Lava'; the submission never names this company, which is an acceptable editorial simplification, not a sourcing error, since every specific claim is still correctly traceable to one of the two cited outlets (only the outlet-level attribution of two GPU-timing figures is wrong -- see finding). source-1 (The Hacker News, Ravie Lakshmanan, '24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login', Jul 28 2026) CONFIRMED verbatim: 'Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login' (exact match to the article's Overview lead and to the task's specific figures-to-verify: 24,650 of 36,872); CVE-2013-4786, CVSS 7.5, described as 'a high-severity information disclosure flaw' (exact match); Dell advisory quote 'this is an inherent problem with the specification for IPMI v2.0' with no patch available (verbatim quote, correctly attributed to Dell via The Hacker News); Michael Katchinskiy quote 'the exposure also affected modern Supermicro and HPE servers operated by GPU providers, including systems that were still using factory-issued passwords' (verbatim, correctly attributed); geographic breakdown 'more than 14,000 are located in the U.S. The remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.' (verbatim match to the article's Germany/China/Netherlands/U.K. list); mitigation guidance (block UDP port 623, rotate passwords, disable legacy IPMI, restrict to a private management network). CONFIRMED but MISATTRIBUTED in the submission: 'HPE iLO factory passwords were recoverable within a minute using modern GPU hardware, while Supermicro factory passwords were recoverable in approximately one hour' -- both figures are true and appear here, but the article cites BleepingComputer for them (see finding). Both domains (bleepingcomputer.com, thehackernews.com) are present in config/source_allowlist.txt. No snapshot failed, so no WebFetch fallback was needed for either cited source. Per the review brief's security note: this submission's two cited sources are bleepingcomputer.com and thehackernews.com only -- lavahq.io (the research firm's own site, reportedly containing an indirect prompt-injection attempt per another agent's report) is not among this submission's sources and I did not access it; no live WebFetch of any kind was required for this review since both citation snapshots succeeded.

The headline figure (24,650 of 36,872) and the CVE-2013-4786 attribution -- both specifically flagged for verification -- are exact, verbatim matches to The Hacker News snapshot. Every other checked specific (6,240 empty-username hosts, 2,340 wordlist-matched passwords, 39% U.S. share, Supermicro chassis-label password format, the HPE Apple-M3 1-day figure, the 0.3 BTC ransom note, both vendors' responses, and both direct quotes) traces correctly to its cited source, with correct verbatim quotation. The one issue found: two GPU crack-time figures (Supermicro ~1 hour, HPE ~1 minute) are real and sourced, but to the wrong outlet -- they appear in The Hacker News, not BleepingComputer as the article states. This is a body-only misattribution; it does not touch the headline, summary, or Overview lead, and does not affect the article's central, well-supported thesis.

A rigorously accurate, well-sourced News piece on a serious data-center security exposure. The headline claim, the CVE attribution, both direct quotes, and nearly a dozen other specific figures were individually verified against the source snapshots and are all correct and correctly attributed. The single issue found -- two real, sourced GPU crack-time figures cited to the wrong outlet -- is a subordinate body-level attribution error, not a fabrication, and is honestly and fully coverable in a single public corrections note. APPROVE_WITH_CORRECTIONS.