Re: AS/400 break-ins...

[pytel@xxxxxxxxxx]

>> Did you know that the SNA protocol used on the ECS line has the potential
>> to startup DDM or other jobs on your inhouse computer without a password?

It requires a lot of configuration to set up system to accept incoming APPC
requests without password.
With default settings it's not possible.

>> What about the APPC connections made when service director is transferring
>> information?

Do you mean that IBM is eavesdropping on your system ?

Best regards
    Alexei Pytel


mcrump@ballfoster.com on 09/15/99 07:52:32 AM

Please respond to MIDRANGE-L@midrange.com

To:   MIDRANGE-L@midrange.com
cc:
Subject:  Re: AS/400 break-ins...






We had an authorized (thanks to our parent company) break-in attempt by our
external auditors.  They were given an IP address on our network and went to
work.  Fortunately, they are not as smart as you Steve.  They caught a password
being transmitted via email (I have two administrators who share one ID for
security work - that's now fixed) and used it to access the system.  Fortunately
between PentaSafe and the security tools reports I caught it and reported it up
the line.  Then I got to watch them try some different things over the next week
or so.  It was 100% TCP/IP based in approach.......it was actually pretty basic
stuff.  We are so fortunate that most of the people who do this are typically
AS/400 ignorant....

Next time, though I think I will go on the offensive and retalliate....... :-)

Steve, are you going to do any more security seminars?

Mike


Did you know that the SNA protocol used on the ECS line has the potential
to startup DDM or other jobs on your inhouse computer without a password?

What about the APPC connections made when service director is transferring
information?

Did you know that there are some startup requests that have NO EXIT PROGRAM
control?

The IBM reference Tips and Tools on Securing your AS/400 has a lot of meat.
Unfortunately most people don't spend the necessary time to properly secure
an AS/400.








+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---