Re: OS/400 User Account Name Disclosure Vulnerability

[sydnic@xxxxxxxxxx]

Quoting Leif Svalgaard <leif@leif.org>:

> From: Scott Klement <klemscot@klements.com>
> > On Mon, 4 Mar 2002, Vernon Hamberg wrote:
> > > Properly administered, it would be extremely difficult to
> > > hack it. It's almost impossible to put a worm or virus or similar
> item on
> it.
> > >
> >
> > I'm sorry, but this statement is simply wrong.
> > The popular "buffer overflow" method of hacking into a system would
> not
> > work on an OS/400 system, thanks to the MUCH different way that
> pointers
> > work -- however, other methods of hacking would work quite nicely.
> >
> > The OS/400 community has always believed in "security by ignorance"
> > -- and I don't agree with that line of thinking
>
> I will have to agree with Scott. Believing that the AS.400 cannot be
> hacked
> is a dangerous "stick your head in the sand" attitude.

I also agree with Scott. Any computer can be hacked. especially if it is on a
network. It does not matter if that network is external to the organisation or
internal.

Ignoring the security threat from ANY connection to the machine, whether
internal or external is rather like the dinosaurs saying 'Asteroid, what
Asteroid??'