IBM i (AS/400) penetration testing

The engagement

Real attacks, from a realistic attacker position.

The experts at Silent Signal have unique competence for security testing of IBM i (formerly AS/400) systems. These systems process critical business data, yet their security testing is typically skipped or only superficial because of their unusual operation — a trend reinforced by myths about "bulletproof" midrange systems.

Our comprehensive IBM i audit service is based on our own lab environment, where we have developed audit methodology and testing tools that go significantly beyond publicly documented methods. With this approach we have demonstrated critical vulnerabilities — including 0-day vulnerabilities — caused by incorrect operational practices or bugs in the manufacturer's software.

Because real-world attacks often rely on compromised user workstations, tests are best run from low-privilege user credentials. From this assumed-breach position, our testers find ways to gain full control of the IBM i system. The results let you apply fixes and mitigations across multiple layers, for robust protection against realistic attackers.

• Demonstrate practically exploitable vulnerabilities, not theoretical findings.
• Include "green screens" and other platform-specific services in scope.
• Test the security of vendor-supplied, third-party and internally developed applications.