Re: Rewarding Challenge AS/400

[Chuck Lewis <clewis@xxxxxxxxxx>]

Bruce,

Thanks for the GREAT information and hopefully we will know something SOON (?).
Nice to know someone that can get attention focused on things like this from the
list :-)

And Leif ! Thanks for letting us know about his, but come on buddy; let's get an
APAR in for ALL our sakes :-)

Chuck

bvining@VNET.IBM.COM wrote:

> IBM is aware of, and is not ignoring, the encrypted password issue
> being discussed here.
>
> IBM is also aware of the claim that Leif is able to bypass AS/400
> security to get to OS/400 objects.  We take this claim very seriously.
>
> IBM accepts APARs on all security related issues.  Despite repeated
> requests, the company Leif works for has refused to submit an APAR with,
> or to provide, the details of this second claim.  We are attempting to
> reproduce the claimed attack; however, with no more information than has
> been made available on this forum, we are not at this time able to
> confirm the exposure.  We are continuing our investigation.
>
> IBM welcomes an APAR submission by Leif, his company, or anyone else
> that includes the details of this second claim.
>
> Let us look at the method used.  To launch a brute-force attack on a
> password, you must have the encrypted password.  How do you get that
> value?  You get it through either an API or service tool.  To use the
> API, you must have *ALLOBJ and *SECADM special authorities.  To use
> service tools, you must have either *SERVICE special authority or access
> to DST and then know how to find the value.  Who should have these
> special authorities or access?  Only trusted individuals - in other
> words, your security officer.  The average user should not be given this
> access or special authorities and, therefore, will not able to launch
> a brute-force attack against an encrypted password.
>
> In addition, the use of these interfaces can be audited so even when a
> trusted individual uses these interfaces, you can know it.  To restrict
> access to DST, we recommend that access to the system itself be
> restricted; and, for units where a keystick is available, the key
> position be set to secure and the keystick removed and placed in a
> secure location.
>
> That said, we are investigating alternative password encryption schemes
> for use on AS/400.
>
> Bruce Vining
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---