Speak to a real person

Speak to a real person

OpenVMS and Security

Written By

Angus Durie

|

This was one of my favourite topics back in the day and given the current focus on hacking it’s starting to get my attention again. Just today I received an email from a transport organisation I use infrequently; apparently a 3rd party company they use to “manage” their customer communications database has been compromised. The good news is no financial information has been taken, the not so good news is they now have my name and email address (I look forward to some of the emails I’m going to get in the future).

At a personal level I’m pissed that an organisation I trusted has managed to give away some of my private information, at a professional level I’m both amazed and disgusted that yet another major organisation has been hacked, do these people never watch the news – Marks & Spencer, Jaguar Land Rover etc.

So what has this got to do with OpenVMS, well remember Kevin Mitnick, the infamous hacker who could never break into a properly managed OpenVMS system (note: properly managed). He was the best of his era and he couldn’t break OpenVMS. I also saw an article this week which highlighted the fact that the US Nuclear capability runs on “old” IBM equipment and is air gapped (new to me as well), making it much safer than more modern systems.

So what has this got to do with OpenVMS, well if I was an OpenVMS IT manager I’d be feeling pretty comfortable talking to my boss (assuming I’ve set the system up correctly) about hacking and 3rd party infiltration. The OpenVMS universe has always known about the security capabilities of the OS, maybe it’s time we shouted more loudly about them.

2 responses to “OpenVMS and Security”

  1. Ray Chapman Avatar
    Ray Chapman

    OpenVMS has never been compromised by the O/S software alone; however there was an instance where a Russian University managed to so using a hardware flaw in the shared memory system of a couple of Vaxen.
    There was a plonker called Simon Clubley who says he found a ‘hole’ but this was something I had discovered some 20 years before him and whilst it manifested itself as an overflowed command language buffer, it never allowed the user to compromise the system. It was a bug – simple as that – not a security design flaw.
    Plonker Clubley still hasn’t claimed the £10,000 I offered to pay him to prove that what he spouted was true btw.
    “A wise man knows he’s a fool, but a fool needs to be told” applies to Clubley in spades …

    Reply
    1. Newcorp Avatar
      Newcorp

      Cheers Ray for your insight, I think the fact that we are talking about 2 episodes, neither of which caused any real ructions goes to prove the point about security on OpenVMS. One can never be complacent but as we said OpenVMS system managers can probably feel a bit smug right now.

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *