Re: IBM i for Wintel Hackers - Silent Signal TROOPERS24 Presentation

I'll point out that IBM's general solution to tighten security in the OS,
since v5r2(?), is to qualify object names.

IBM manages to roll out changes and test objects without futzing with
the library list.

And IBM even recommends
<https://www.ibm.com/docs/en/i/7.4?topic=lists-recommendations-user-portion-library-list>

- Use qualified names (object and library) in your applications. This
prevents the system from searching the library list to find an object.

But that doesn't mean that's the only way to handle it. There are other
options if you need to use the library list. You'll just need to ensure
you are doing so securely.

The problem as I see it, isn't what functionality is available,
well...except for the vulnerabilities discovered/demo'd in the OS

The problem that many applications originated decades ago when the security
environment was a lot different; and we've just kept things the same. The
old "it doesn't seem broke, we aren't going to fix it."

Watch the whole video Rob. It's eye-opening.

Charles




On Mon, Sep 16, 2024 at 12:23 PM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

I read the overview and it seems to have a real problem with the concept of
using a library list. Their fear is that someone could put a version of
the program higher in a library list which, while it has the same name,
does something completely different.
Their cure is to hardcode all program calls. So, instead of CALL MYPGM you
use CALL MYLIB/MYPGM. This would play havoc with rolling out changes and
test libraries.

Well, if I can stick this in a library higher in the library list, what's
to stop me from sticking it into the original library?



On Thu, Sep 5, 2024 at 2:39 PM Charles Wilt <charles.wilt@xxxxxxxxx>
wrote:

A must watch IMHO..
Agenda, slides, and video link
https://troopers.de/troopers24/talks/7sfsbf/

Direct to video
https://youtu.be/t4fUvfzgUbY

Charles
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.