× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



I've had several iseries on the net for telnet for years. They get hit, but
they never get in.

Jack

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bentley Pearson
Sent: Wednesday, May 20, 2009 3:29 PM
To: Midrange Systems Technical Discussion
Subject: RE: Is someone trying to hack my system?

Bob, when you stated that "yes, it is on the net, we use TELNET", could
you further describe "how" you use telnet for remote access? Do you have
the remote user open a telnet session using 5250 emulation software and
just enter the IP address of the SystemI in the host name field? OR does
the remote user first have to establish a VPN connection with your
domain and then commence a 5250 telnet session using the DNS name or
internal ip address of the SystemI?

If you do not have a firewall in place and do not use a VPN then you
have some extremely serious exposures.

At a past employer, the SystemI was visible to the "net", no VPN in
place. It was a development machine and did not contain any useful
information and it was "touched" constantly by outsiders. VERY SCARY.
The powers that be at that company just did not understand the exposure.




Bentley Pearson
Vice President - Information Services
Southland National Insurance Corporation
1812 University Blvd
Tuscaloosa, Al
35403
205 345 7410
bpearson@xxxxxxxxxxxxxxxxxxxxx


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Josh Diggs
Sent: Wednesday, May 20, 2009 1:26 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Is someone trying to hack my system?

Take option 3 Work with TCP/IP connection status. Review the list for
"normal" activity. If you suspect people are currently attached that
should not be, review your connections that are in an Established state
and drop the ones which are not authorized.

As soon as possible, review the ports which are in Listen state and
change configurations so that unnecessary ports are not open.
Immediately after that establish perimeter security (firewall) to
enforce rules about which connections are allowed and from what origins.
These are not trivial tasks. You may need some help, and you want to do
this as urgently as possible.

Good luck

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bob Voltz
Sent: Wednesday, May 20, 2009 10:58 AM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Is someone trying to hack my system?

This activity is not normal.

What would I look for with NETSTAT?

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Josh Diggs
Sent: Wednesday, May 20, 2009 1:36 PM
To: midrange-l@xxxxxxxxxxxx
Subject: RE: Is someone trying to hack my system?

I would say yes. These logs show that someone from the internet is
connecting to your computer. If someone from the internet can connect
to your computer, hackers from the internet can connect to your
computer. It then follows that someone is trying to hack your system.

It does not follow that these examples are said hackers. You need to be
able to define what normal use is. The fact that two of these are
Chinese IPs and the other two are African (I think), would be a concern
for us, but if you do business in China and Africa, maybe that's normal
for you.

Try using netstat to determine if there is anything unexpected happening
on the network.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.