Power Corrupts, Corrupt It Back! Hacking Data Center Power Management
Uncovers nine vulnerabilities across enterprise Power Distribution Units (PDUs) and Data Center Infrastructure Management (DCIM) appliances, enabling physical power disruption.
Summary
The Overlooked Physical Infrastructure of Data Centers
While cloud security focuses on virtualized workloads and IAM permissions, data center physical power distribution and environmental controls represent critical single points of failure.
Auditing Enterprise PDUs and DCIM Systems
Patrick Quinn and Gary Chick conduct in-depth vulnerability research against leading commercial Power Distribution Units (PDUs) and Data Center Infrastructure Management (DCIM) appliances.
Discovering Nine Critical Vulnerabilities
The researchers disclose nine vulnerabilities—spanning unauthenticated remote code execution, command injection, and insecure firmware updates—that allow remote control over electrical circuits.
Simulating Cascading Power Disruptions and Mitigations
Demonstrating coordinated outlet cycling and transformer load surges illustrates how compromising power management can physically damage data center hardware and trigger cascading outages.
Related talks
Main Stage·33 min
Anthony Rose · Jake Krasnov
Uncovers widespread firmware backdoors and hardware vulnerabilities in commercial solar inverters and energy management gateways across global supply chains.
Main Stage·43 min
Daniel Jensen
Daniel Jensen details hunting for vulnerabilities across Aruba's on-premises network management and wireless controller appliances, uncovering pre-auth RCE.
Main Stage·39 min
Octavio Gianatiempo · Octavio Galland
Octavio Gianatiempo and Octavio Galland audit top-selling consumer routers, discovering systemic OEM firmware vulnerabilities that enable zero-click remote RCE.