RE: IBM's benevolent hacking

[rob@xxxxxxxxx]

Some was OS/400, some Domino, but most of it was networking.  And, like 
most people say, OS/400 is pretty secure, providing you use it that way. 
None of these recommendations were the age-old, and worthless, 
recommendations often touted by the accounting firms that do IS audits, 
like "Change system value QLMTDEVSSN".

Jeepers Joe, you get pretty defensive about OS/400, don't you?  I can't 
blame you, just don't let it blind you.

And it was some part of IBM Global services, my boss did the actual 
contracting.  Searching their page for hacking gets a few hits like 
http://www-1.ibm.com/services/us/index.wss/so/bcrs/a1002422

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
01/27/2005 01:03 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: IBM's benevolent hacking






I'm not sure what this paragraph means, but I'll bite.  It sounds like
your security setup is pretty terrible.  Additionally, it sounds like
you're blaming at least some of your problems on OS/400, but you're not
going tell us what those problems are.

If that's the case, then maybe you can tell us what part of IBM you
contracted with, and exactly what you contracted to them for, and that
way your post might have some benefit to the rest of us.

Joe


> From: rob@xxxxxxxxx
> 
> Contracted with IBM to do benevolent hacking.  Greatest outsourcing
we've
> ever done.  Got this 40+ page document.  It listed several "incidents"
we
> need to address.  I am not permitted to post them on this list.  On
thing
> that I thought was pretty sharp, IBM called and said "person ... went
to
> website ... and that tried to install some malicious code.  You need
to
> block ...".  Now I have to open a new flurry of pmr's that I would
love to
> post to this list but a rather stern warning from the boss, and, well,
> that ain't going to happen.

-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.