Re: Sasser connects to AS/400

["Adam Lang" <aalang@xxxxxxxxxxxxxxxxxxxx>]

I was trying to imply that it isn't a direct attack on the AS/400, but that
if it is an attack on Windows file shares, then yes, it should affect the
AS/400 via that route.
----- Original Message ----- 
From: "Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, May 04, 2004 11:41 AM
Subject: RE: Sasser connects to AS/400


> >Also, it isn't connecting to the "AS/400" perse.  It is connecting to
> >Windows shares, which Netserver emulates.
>
> Adam, sorry, but that qualifies as techno-babble-speak as far as I'm
> concerned. If the connection comes into a physical machine that says
> AS/400 (or iSeries (or i5)) on the front panel then it's a connection to
> the AS/400.
>
> -Walden
>
> ------------
> Walden H Leverich III
> President & CEO
> Tech Software
> (516) 627-3800 x11
> WaldenL@xxxxxxxxxxxxxxx
> http://www.TechSoftInc.com
>
> Quiquid latine dictum sit altum viditur.
> (Whatever is said in Latin seems profound.)
>
> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Adam Lang
> Sent: Tuesday, May 04, 2004 11:11 AM
> To: Midrange Systems Technical Discussion
> Subject: Re: Sasser connects to AS/400
>
> I would assume there are infected PCs in his internal lan.
>
> Also, it isn't connecting to the "AS/400" perse.  It is connecting to
> Windows shares, which Netserver emulates.
>
> ----- Original Message ----- 
> From: "Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>
> To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
> Sent: Tuesday, May 04, 2004 11:04 AM
> Subject: RE: Sasser connects to AS/400
>
>
> > >this IP address is not publicly known.
> >
> > Oliver, is it accessible from the 'net? If so the IP is publicly
> known.
> > Many (most?) worms simply scan IPs, they are in predictable format
> after
> > all. They may not know that the IP belongs to you, but they know it's
> an
> > IP address.
> >
> > Also, what do you mean by "remote pc's (other WAN locations)" do you
> > mean remote locations that are still inside your corporate network, or
> > are you talking about Internet locations? If the latter (and maybe
> even
> > if the former) why are you even allowing 445 through the firewall?
> >
> > -Walden
> >
> > ------------
> > Walden H Leverich III
> > President & CEO
> > Tech Software
> > (516) 627-3800 x11
> > WaldenL@xxxxxxxxxxxxxxx
> > http://www.TechSoftInc.com
> >
> > Quiquid latine dictum sit altum viditur.
> > (Whatever is said in Latin seems profound.)
> >
> > _______________________________________________
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.