24
Tue, Dec
0 New Articles
  1. You are here:  
  2. Home
  3. Security
  4. IBM i (OS/400, i5/OS)
  5. Fact or Fiction: Critical Security Flaws Are Found in IBM i

Fact or Fiction: Critical Security Flaws Are Found in IBM i

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Carol Woodbury discusses a recent presentation at Defcon asserting that there are critical security flaws in IBM i.

 

As a security professional who's made her career espousing the virtues of IBM i security, it's disconcerting to receive an email from a client with the title, "New Critical Exploits for iSeries Announced at Defcon." Defcon for those of you who are not familiar, is one of the world's largest hacker conventions. It's held annually in Las Vegas. The presentation was called "Hack the Legacy! IBM i (aka AS/400) Revealed." Not that IBM i security is perfect or has never had flaws, but to see IBM i as the topic of a presentation at Defcon makes you sit up and take notice!

 

I opened the slides attached to the email with a bit of trepidation and then I realized that, as with most presentations I've seen that use grandiose and gee-whiz demos, this author had taken significant liberties and had obviously configured his system to be in an unnatural state. Kind of like the Labradoodle dog…yes, it's a dog, but the characteristics of this dog don't naturally occur in nature. Yes, this presenter describes vulnerabilities, but most of them are the result of purposefully misconfiguring his system or specifically taking advantage of the fact that he is using a profile that has *ALLOBJ and *SECADM special authorities. I'll describe a few of the issues and then, unlike the presenter, discuss some actual issues that we need to be aware of.

 

Let me say that I did not attend this presentation, so I can only comment on the content of his slides. My experience and my investigation into these so-called "flaws" says that if there had been something of note in this session, there would be a set of fixes coming quickly. I am confident that there are no fixes coming for any of these "issues." It appears to me that all "flaws" can be avoided with good security practices.

 

Let's take a look.

 

One of the assertions was that you could easily switch to run as a different profile. His assertion hinged on the fact that end user profiles were in the same group as administrators and programmers and that that group owned all of the profiles on the system. Two problems with this assertion: While it's obviously possible, I have never seen a system where all users are a member of the same group. Perhaps all end users are a member of the same group, but I have never seen programmers, operators, and administrators in the same group as end users. It is true that anything the group owns, the users also own (that is, have *ALL authority to). And certainly, if I have *ALL authority to a user profile, I can use several methods to change my job and run as that profile—even a profile with more privileges than mine. Here's where the example falls down: the appropriate use of group profiles demands that you group like sets of users. In other words, you put everyone who performs the same job (role) in the same group. You don't put users in totally different roles into the same group. So his example doesn't make sense. What he could have shown—and which I have seen—is when the *PUBLIC authority of user profiles has been changed from the default setting of *EXCLUDE to *USE. This is an exposure. Setting a profile to be *PUBLIC *USE gives all users on the system the ability to submit a job and run as this profile. If the profile has *ALLOBJ and *SECADM, it allows the user to submit a job and create a new profile that also has *ALLOBJ and *SECADM and now that user can have some real fun. Can there be an exposure with the authorities associated with a user profile? Absolutely! Just not the examples he was showing.

 

Another assertion was that an end user could run a remote command and that this ignores the limited-capability setting in the user profile. Excuse me, but that's hardly new news! Anyone who has paid attention to IBM i security in the last 15–20 years knows that the limited capabilities setting in the user's profile is of limited (pun intended) value. What is required to protect your data is object-level security. If the user doesn't have authority to download or upload (modify) a file, I don't care what interface is used—remote command, ODBC, JDBC, etc.—the attempt will fail. Clearly the presenter was either using a profile with *ALLOBJ special authority or had applied no object authorities.

 

An assertion that was also very misleading is that anyone can use the QSYRUPWD API to get IBM i user profile passwords. This API is intended for use by HA and password synchronization vendors to allow you to have the same password on multiple systems. The first problem with the presenter's assertion is that this API can be run only by a profile that has *ALLOBJ and *SECADM special authorities—not just any end user. Second, even if you determine how the value returned by this API is formatted, it's still not the user's password. As the V7R2 IBM i Security Reference manual documents, users' actual passwords are not stored. The password is used as the key to encrypt the user profile name. Only a brute-force attack is going to get you back a user's password. Finally, the API returns only one value at a time—not the entire set of IBM i profiles. Unlike the sensational assertions of the presenter, there are some actions you can take to protect your system:

 

  • (Obviously) limit the number of profiles that have *ALLOBJ and *SECADM special authorities.

    •  

     

  • Audit the use of this API; if you detect use by something other than your HA or IDM (Identity Management) solution, send yourself an alert.

    •  

     

  • Run at a minimum of QPWDLVL 1, but better is QPWDLVL 3, which increases the character set of your passwords to be both uppercase and lowercase letters, any special character, and numbers.

    •  

     

  • Require the use of complex passwords—especially for profiles with *ALLOBJ and *SECADM—to make it more difficult to perform a brute-force attack to obtain valid passwords. The easiest way to do this is to use the options provided by the QPWDRULES system value.

    •  

     

    Final Thoughts

    Critical Security Flaws in IBM i: Fiction! While I have definitely seen what I would consider to be critical flaws in numerous systems' IBM i security settings, this is a result of the choices made by administrators, not a result of vulnerabilities in the operating system. No good can come from IBM leaving an exposure for which there is no fix. When there's an exposure revealed in a current release, IBM will provide us a fix. It's up to us to responsibly implement the features provided by IBM to protect our systems and data. It's also up to us to watch for and apply Integrity PTFs as soon as possible. Integrity PTFs have direct security implications. Best practices say that these should be applied as soon as possible. Staying current with PTFs, in general, is also a good practice.

     

    Am I upset that this presentation was given? Yes and no. Plenty of examples of common configuration mistakes are available that show how data can be left vulnerable on IBM i without having to show examples of configurations that are contrived. This makes me irritable because time is wasted explaining that these exploits don't make sense and that if you follow common-sense security rules, these assertions don't apply. However, I'm always happy when IBM i is discussed outside of the normal IBM or user group conferences—even at hacker conferences. This helps raise awareness and provides hard evidence that IBM i is known in the hacker community. I often tell my classes that this is the case, but most of the time I don't think attendees believe me!

     

    We all need to be diligent about how we protect our data. Data residing on IBM i is no different.

     

    BLOG COMMENTS POWERED BY DISQUS

    LATEST COMMENTS

    Support MC Press Online

    $

    Book Reviews

    Resource Center

    • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

    • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

    • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

    • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

    • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

    • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

    • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

    • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

    • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

    • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

    • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

    • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

    • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

    • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

    • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

    • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

    • SB Profound WC 5536Join us for this hour-long webcast that will explore:

    • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: