|
Just to add one thing to the great information provided by John ... On a system with security level 30 or lower, another was to exploit weak security is via job descriptions. If a *jobd is setup with an actual user profile for the User parameter (as opposed to *rqd), it is possible to hijack the authority from that profile. My first day on the job at my current place of employment, I sat down at a PC, got the AS/400 sign on screen and had myself a *SECOFR user profile created within a couple of minutes - all of this without having anyone create a profile for me. Todd Kidwell (Netstar) AS/400 System Administrator (313) 224-0578 >>> "John Earl" <john.earl@xxxxxxxxxxxxx> 01/28/04 06:25PM >>> Breaking into an iSeries is as easy as the system administrator allows it to be (and based on our experience auditing machines, that would be "too damn easy"). The steps are as simple as 1,2,3... Access, Explore, Attack.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=iso-8859-1"> <META content="MSHTML 6.00.2800.1276" name=GENERATOR></HEAD> <BODY style="MARGIN-TOP: 2px; FONT: 10pt Tahoma; MARGIN-LEFT: 2px"> <DIV>Just to add one thing to the great information provided by John ...</DIV> <DIV> </DIV> <DIV>On a system with security level 30 or lower, another was to exploit weak security is via job descriptions. If a *jobd is setup with an actual user profile for the User parameter (as opposed to *rqd), it is possible to hijack the authority from that profile.</DIV> <DIV> </DIV> <DIV>My first day on the job at my current place of employment, I sat down at a PC, got the AS/400 sign on screen and had myself a *SECOFR user profile created within a couple of minutes - all of this without having anyone create a profile for me.</DIV> <DIV> </DIV> <DIV>Todd Kidwell (Netstar)<BR>AS/400 System Administrator<BR>(313) 224-0578<BR><BR>>>> "John Earl" <john.earl@xxxxxxxxxxxxx> 01/28/04 06:25PM >>><BR>Breaking into an iSeries is as easy as the system administrator allows<BR>it to be (and based on our experience auditing machines, that would be<BR>"too damn easy"). The steps are as simple as 1,2,3... Access, Explore,<BR>Attack.<BR></DIV></BODY></HTML>
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
