RE: Re: Recent bugtraq postings

["Jones, John \(US\)" <John.Jones@xxxxxxxxxx>]

If you're using LAN/Ops Console or an HMC, you need to authenticate to
it as well before you can even access the console. 

And depending on your model, you'll need a physical or logical key to
change the IPL mode to get in to DST.

John A. Jones, CISSP
Americas Information Security Officer
Jones Lang LaSalle, Inc.
V: +1-630-455-2787  F: +1-312-601-1782
john.jones@xxxxxxxxxx

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steve Richter
Sent: Monday, April 25, 2005 11:37 AM
To: Midrange Systems Technical Discussion
Subject: Re: Re: Recent bugtraq postings

On 25 Apr 2005 16:26:58 -0000, shalom@xxxxxxxxxx <shalom@xxxxxxxxxx>
wrote:
> Hi Steve,
> 
> You asked
> > Show me where to find a Linux "boot disk" that will allow you to
change QSECOFR's > password like you can with the Administrator password
in Windows:
> 
> Your iSeries comes with a built-in "boot disk" that allows you to do 
> exactly what is described in the article you rerer to. It is called 
> DST, and it requires physical access to the server (just like the boot
CD trick).

you need physical access and a password to use SST to hack into an
as400.  In the example Steve posted, you only need physical access to
the PC  ( although, you could probably use a BIOS password to disable
the floppy drive )

-Steve

> 
> The iSeries platform is not more secure, it is more securable, and 
> only if you know what security issues to look after.
> 
> Cheers,
> Shalom Carmel
> -------------
> www.venera.com - Exposing iSeries insecurity
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

> list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, 
> unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take 
> a moment to review the archives at 
> http://archive.midrange.com/midrange-l.
> 
>

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.




This email is for the use of the intended recipient(s) only.  If you have 
received this email in error, please notify the sender immediately and then 
delete it.  If you are not the intended recipient, you must not keep, use, 
disclose, copy or distribute this email without the author's prior permission.  
We have taken precautions to minimize the risk of transmitting software 
viruses, but we advise you to carry out your own virus checks on any attachment 
to this message.  We cannot accept liability for any loss or damage caused by 
software viruses.  The information contained in this communication may be 
confidential and may be subject to the attorney-client privilege. If you are 
the intended recipient and you do not wish to receive similar electronic 
messages from us in the future then please respond to the sender to this effect.