RE: DB2UDB hack

Thanks -

I'm pretty confident that the signon process itself is protected, but
with out SSL, all other traffic that flows between the PC and the System
i using iSeries navigator would be in clear text.

jte

--
John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx




Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.

===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
bounces@xxxxxxxxxxxx] On Behalf Of Lukas Beeler
Sent: Thursday, October 25, 2007 7:11 AM
To: Midrange Systems Technical Discussion
Subject: Re: DB2UDB hack

On 10/25/07, John Earl <john.earl@xxxxxxxxxxxxx> wrote:

You start iSeries Navigator, connect to your system. Your password

is

sent in plain text, so everyone can read it and enjoy your QSECOFR
rights!

Because iSeries Navigator uses the *SIGNON server to authenticate, I

was

under the impression that the iSeries navigator signon process was a
secure hash exchange and not flowing userid's and password in clear
text. Can you elaborate or explain the vulnerability here?

That would make a lot of sense, and i do not exactly know how this
services works.

I based my assumption that the logon is not secure on the fact that it
is not using SSL, but can be configured to do so:
http://www-
1.ibm.com/support/docview.wss?uid=nas2fcc664db54c4c549862568720047b5fd

But if it using a secure Challenge/Response way for authenticating the
user, it would be secure SSL. A quick google search did not yield
results for me, so i might be wrong.

--
Read my blog at http://projectdream.org
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.