APC Smart-UPS SMT/SMC/SMX/SCL/SMTL series - firmware update signing: PHYSICAL and PERSISTENT

Impact

PHYSICAL and PERSISTENT. Firmware images are signed with a key that leaked, so an attacker can flash arbitrary firmware onto the UPS and have it accepted as genuine. This is the worst of the three TLStorm bugs for an operator: the implant lives in the power device, survives every reimage of every server behind it, and is invisible to anything you run on the compute plane. An attacker who owns the UPS owns a kill switch for the racks it feeds, on a timer of their choosing.

Who can reach it

Network access to the UPS - either directly on the management network or via the intercepted cloud channel. Also reachable by anyone who can push a firmware image through the vendor's own update path.

What to do

Flash to fixed firmware, which changes the signing scheme. Because the compromise persists in firmware, patching alone does not prove cleanliness on a unit you believe was targeted - the honest answer there is re-flash from a known-good image and verify the reported firmware version out of band. Treat UPS firmware as part of your supply chain: version-inventory it, and refuse units that cannot report a verifiable firmware version.

References