Re: 5250 sessions killing the system

Not the best assumption. I have a customer that got clobbered with a ransomeware attack, and they had all the right stuff in place too. Wiped out everything except the IBM i instances.

IBM i smiled at it and stopped it. Not even the IFS had any damage since the security and read/write permissions were set properly.

Jim Oberholtzer
Agile Technology Architects

On Nov 14, 2019, at 1:46 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

I think the assumption is that with all the TrendMicro, etc we got going on here it would have been flagged by those by now.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of David Gibbs via MIDRANGE-L
Sent: Thursday, November 14, 2019 2:33 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: David Gibbs <david@xxxxxxxxxxxx>
Subject: Re: 5250 sessions killing the system

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

On Thu, Nov 14, 2019 at 1:06 PM Rob Berendt <rob@xxxxxxxxx> wrote:
I have this case opened with IBM. There are certain clients attaching to the system where it starts 10,000+ port 23 (telnet) connections to our system. All using the same 1-3 workstation id's. Totally blows our activity level out of the water and is quite an effective denial of service attack.

You've ruled out workstation virus / malware?

david

--
IBM i on Power Systems: For when you can't afford to be out of business!

I'm riding in the American Diabetes Association's Tour de Cure to
raise money for diabetes research, education, advocacy, and awareness.
You can make a tax-deductible donation to my ride by visiting
https://mideml.diabetessucks.net.

You can see where my donations come from by visiting my interactive
donation map ... https://mideml.diabetessucks.net/map (it's a geeky
thing).

I may have diabetes, but diabetes doesn't have me!
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com