Thanks for this investigation. I was trying to think of what an actor in a position to insert such chips at a manufacturing level would actually want. You've got some tough limitations - you want a security hole that you can exploit on highly firewalled, monitored, and locked-down servers running a variety of software types. But it also needs to be hard to detect and exploit without knowing some sort of secret. If anyone notices you using the exploit, you're screwed. If any security researcher or black-hat hacker finds it too, you're also screwed. It'd have to be pretty good to avoid that, since those guys are probably fuzzing servers all the time. You'd have to be very careful how you used it - if anybody traces a known data breach to this, then you're screwed too.
Presuming you can get control of the BMC and transmit arbitrary network traffic, you'd have to limit it somehow. At least some of the compromised servers would be installed in places where any unexpected outgoing network traffic would be noticed and investigated. Large amounts of detectable traffic could be generated too if these things are all pinging away at something. You'd have to trigger it somehow I suppose. But what kind of trigger can you set up on a server running an unknown OS in unknown configuration that may be behind lots of firewalls? Are we sending some kind of weird magic packet to the server? If I was Google or something, I'd have dumb filtering firewalls set up in front of my servers that drop anything that doesn't look like normal network traffic, just to keep any random person from fuzzing the server and triggering some weird unknown bug.
