[Info-vax] WASD startup and shareable images

[Stephen Hoffman]

On 2019-07-08 19:39:04 +0000, Dave Froble said:

> On 7/8/2019 1:59 PM, Simon Clubley wrote:
>> Regardless of what some people might tell you, VMS is just like any 
>> other operating system when it comes to vulnerabilities.
> 
> Actually, that could be a good thing.
> 
> Hobby usage is not suppose to be used for commercial and such purposes. 
> Therefore, what is lost if the system is compromised?  If the intrusion 
> method is recognized, future protection against such could be 
> implemented.
> 
> Recovery is as simple as an image restore of the disk.
> 
> Everyone does do image backups, right?

Assuming the breach is isolated and hasn't been extended through the 
user's whole network.  Some folks aren't good at network isolation, and 
aren't good at locking down local network traffic, though.

And assuming the folks didn't use the OpenVMS box for DDoS and other 
shenanigans.  There have been some quite persistent folks fond of using 
DDoS tools on OpenVMS to hose other folks elsewhere on the network.  To 
my then-surprise, some of the available DDoS tools do directly work on 
OpenVMS and without modifications, too.

And that's ignoring the mess that reflection attacks and other dreck 
have caused for network usage and for other sites on the 'net, due in 
no small part to down-revision server software on OpenVMS.  The OpenVMS 
NTP server was very popular for folks conducting reflection attacks.

Then there's the insecure connections, such that a remote access into 
OpenVMS may well compromise the access credentials necessary.  I've had 
my Wi-Fi traffic captured some years ago.  Sitting in a then-HP 
senior-level security presentation, as well as again in a session 
presented by Whitman and other senior then-HP folks.



-- 
Pure Personal Opinion | HoffmanLabs LLC