HP 3000 Viruses And Hacking

[Craig Forant]

Are there virus's for the HP3000?

Scenario One

A computer is connected to an HP 3000 server via a serial port interface
with software that emulated a terminal (Reflection). This computeris also
connected to the internet through our companies T1/proxy and firewall or
through a dial up connection.

Scenario Two
A computer connected to a Network containing access to a proxy server,
through a firewall, uses Reflection to connect to the HP3000 via TCP/IP.

Is there any possibility that somebody could HACK their way through our
internet connection and route through this computer into the serial port
connection and into the HP 3000 or via TCP/IP and the DTC.

Thanks for all replies in advance.

Craig

Please reply to craig@flyersfan.com

[Bill McNAMARA_1]

via snmp, I suppose, unless you've disabled it.
Which you should have at your firewall.

by nature of unix permissions there are no real viruses, only trojans!

Later,
Bill

[Alexander M. Ermes]

Hi there.
Look at this URL :
http://www.cert.org
That should help you.
Rgds
Alexander M. Ermes

[Stan Sieler]

Re: virus on 3000

There are no known viruses for the HP 3000.


Re: Scenario one

Yes. If you postulate that someone
could get through your firewall and
gain full control of the "computer"
(let's assume it's a PC compatible,
running Windows of some kind), then
with appropriate software they could
then try to access the HP 3000 ...
just like any user/stranger who
walked up to that PC. I.e., they'd
still have to get through the normal
HP 3000 security. On a properly
secured HP 3000, that means at least
one password (a user or account password),
and possibly much more (e.g., if the 3000
is running SECURITY/3000 from VESoft).

In short, gaining access to the PC doesn't
immediately give them access to the 3000.
However, if they installed a keystroke
logger, they could capture the passwords
used to access the 3000. If you're
worried about *that*, then you better
first look at securing that PC :)
Then, you can look at SECURITY/3000,
which can present different challenge
questions at each logon, making the
keystroke capture technique harder to use.
Or, use SecurID card logon ... with that,
the authorized user has a credit-card
size device that presents an apparent
random number (which changes once a minute).
The logon sequence requires entering
the number along with their normal
logon info (user.account). The SecurID
software know what number should be displaying
at any time. Since every logon
will use a different number, this defeats the
keystroke capture technique.


Re: Scenario 2

Uh, if that first computer (let's call
it a PC again) is on the net, and is using
TCP/IP to connect to the 3000, then
the 3000 is either on the same network
*or* your PC has two netword cards and the
3000 is on a second network. In the former
case, why bother with the PC at all in
your scenario? Why not just ask about
hacking directly into the 3000?

The real question here would probably
be one of proper firewall setup: why
do you think your PCs might be accessible
through it?