What is the IBM i System?

Formerly known as the AS/400, the IBM i operating system is enterprise-grade, highly reliable, and robust it is widely used in environments that support critical business operations such as banking, healthcare, and government systems. While IBM i systems are perceived as "secure" due to their closed architecture and long-standing stability, they can in fact contain serious configuration, user-level, or service-based vulnerabilities especially when not properly maintained.

Penetration testing involves a simulated cyberattack, in which an expert team—authorized by the client attempts to identify and exploit the security weaknesses of a given system. In the case of IBM i systems. This is particularly important for IBM i systems, as many of these platforms have been running for decades with increasingly layered permission and service configurations, among which critical risks may easily remain hidden.

• System Configuration Errors: A low QSECURITY level and, weak object restore rules (e.g., QVFYOBJRST and, QALWOBJRST) often allow the execution of untrusted code or programs.
• User and Password Management Issues: Improper QPWDRULES settings, over-privileged (*ALLOBJ) accounts, and inactive or forgotten user profiles may be actively present in the system.
• Information Leakage via Services: For example, error codes or banner information accessible via Telnet, FTP, or POP3 ports.

1. Preparation and Scope Definition: We define the exact scope, testing window, and obtain documented authorization.
2. Information Gathering: Mapping network services, open ports, users, and system configurations.
3. Vulnerability Identification and Exploitation: This includes, accessing the CL command line via the TN5250 protocol, manipulating QSH, and acquiring *ALLOBJ authority, for example.
4. Privilege Escalation: The goal is to obtain higher-level system access and validate its feasibility.
5. Post-Exploitation Steps: Collecting logs, preserving evidence, forming recommendations, and initiating remediation of identified vulnerabilities.

Testing is conducted in accordance with internationally accepted frameworks such as:

• PTES (Penetration Testing Execution Standard)
• OSSTMM (Open Source Security Testing Methodology Manual)

The tools we use include:

• Hack400Tool, TN5250 emulators, Metasploit, Burp Suite, QSH, Nmap
• Custom-developed and tailored audit scripts specific to IBM i environments

Beyond remediating the specific vulnerabilities identified during the penetration test, we recommend the following:

• Set the QSECURITY level to at least 40 or 50
• Strict configuration of critical parameters such as QVFYOBJRST and QFRCCVNRST
• Implement strong, rule-based passwords (QPWDRULES), and introduce multi-factor authentication (MFA)
• Minimize *ALLOBJ privileges; apply role-based access control (RBAC)
• Automatically delete or deactivate inactive accounts
• Disable or strictly control FTP, POP3, and Telnet services
• Restrict QSH access to administrators only, with full logging

At the conclusion of every penetration test, we deliver a comprehensive, audit-ready report that includes:

• Executive Summary: A clear, business-level overview for decision-makers
• Detailed Technical Analysis: In-depth information on each vulnerability discovered
• Priority Matrix and Remediation Roadmap
• Screenshots, Evidence, and Compliance Review: For example, aligning with PCI DSS requirements