[TABLE]This is the fourth chapter of the Ensuring security on i runbook. The aim of this is to provide AS/400 users advice from security experts for the i on how you can advocate for security in your organization effectively, and what to watch out for, and how to review your System i security situation to ensure it's working as well as it needs to be.
[IMAGE]
The AS/400 is considered one of the most secured platforms, however many shops fail to consider the risk from users accessing the platform via desktop application rather than green screen applications. Here we will demonstrate the simplicity of compromising AS/400 security using standard desktop tools by presenting a few scenarios.
To begin with, a hacker wishes to gain access to a fictitious company called ABC in order to gain access read and change sensitive data.
The scenario for Company ABC
Company ABC is using AS/400 with green-screen-based enterprise resource planning (ERP) system and iSeries Access PC5250 is used as the emulation client. The company has established the following policy for the ERP security:
For auto login to sign on server the company uses user profile QUSER with password QUSER . QUSER is defined with LMTCPB set to *YES and no initial program or menu.
The hacker mission
Perform the following with minimum trace available,
Implementation
The hacker will use QUSER user profile. QUSER default password is QUSER and although QUSER is not allowed use green screen it can be used for other access methods to the system.
The hacker will use the well known iSeries Access , it is installed on ABC's offices to allow 5250 emulation.
Phase 1: Find the name of the production library
The hacker's first task is to try and find the exact location of sensitive data in the system. The most convenient way is to look at what other people are doing. So the hacker will login to iSeries Navigator (part of iSeries Access that is inst
To continue reading for free, register below or login
To read more you must become a member of Search400.com
alled to provide 5250 emulation).
In Navigator, the hacker chooses the option to display active jobs, and look in the open files of interactive jobs -> open files.
[IMAGE]
Click image for larger version
Conclusion: Navigator is not limited to users with limited capabilities. In our scenario let's assume we found out company ABC ERP main library is called SAMPLE.
Phase 2: Get list of sensitive tables
The hacker is now looking for tables related to credit cards, and the easiest way is to query metadata:
[IMAGE]
Click image for larger version
The hacker gets a result. The suspected file is in a library they are interested in, so the next step is to get the card numbers.
This step proved that database metadata can be queried without a menu or command line.
Phase 3: The hacker get list of credit card numbers
From navigator we can generate the list of credit cards
[IMAGE]
Click image for larger version
Since QUSER is not part of ERP group they can not alter data but they can read data, and the list of credit cards is exposed.
The audit journal will tell the system administrator someone looked into the credit cards file but this someone is QUSER a generic user.
Phase 4: Find users that we can use for damaging data
QUSER is not allowed to update data on library SAMPLE. So, a hacker needs access with different user. The easiest approach is to find a user profile that user QUSER is allowed to use. The hacker will try to produce a list of user profiles QUSER is allowed to display, this is done by displaying the user profile to out file and then query the outfile:
[IMAGE]
[IMAGE]
Click images for larger versions
Now it is possible to send commands and query the command results.
Phase 5: Damage the system
Since QUSER has authority to ERP user profile it is now easy for example to clear library SAMPLE. We did not include this last step in the article because we believed it would not be wise to include detailed instructions; however, company ABC can now suffer severe damages.
Security infrastructure is insufficient
Company ABC has a security policy that takes care of security; however, the security infrastructure is no longer sufficient. For example,
The company needs to re evaluate the security measurements it uses. A security tool to monitor and control remote access to the system should be procured. Penetration tests should be performed to check the AS/400 security controls against known net attacks and intrusions. These security tests should be designed to test the security countermeasures in use in the AS/400 environment by carrying out penetration attacks from the customer's network and to achieve the following goals:
The AS/400 computer is considered to be one of the most secured systems in the world. However, the changes in the IT infrastructure cause the AS/400 resources to become more available to network users and the vulnerability of the computer increases accordingly. So watch out!
ABOUT THE AUTHOR: Shahar Mor is president of Barmor Information Systems, a consulting firm in Israel, which employs over 20 people that work on projects for the AS/400 in the network environment. He also has written a Redbook for IBM on iSeries e-commerce and he is Search400.com site expert for connectivity issues on the iSeries.
