Re: Recent bugtraq postings

[Steve Richter <stephenrichter@xxxxxxxxx>]

On 4/25/05, Shalom Carmel <shalom@xxxxxxxxxx> wrote:
> About STRPCCMD:
> CA is not the only emulation that supports this command.
> There are at least 3 more emulations by different vendors that can be used
> in a similar manner: Bosanova, PowerTerm, and Mochasoft.
> Because the issue seems to be a generic iSeries 5250 emulation feature, and
> because it works only in conjecture with an iSeries server,
> in my opinion it is an iSeries issue, even though it affects the iSeries
> client and not the server.
> 
> I've checked the capabilities of a user account in windows XP. The good news
> are that no software can be installed by a user account.

way to go Windows! 

> The bad news are that some malware programs do not need installing, but only
> execution rights.

which ones?

> Of course, letting users run their PCs with local administrative rights is a
> common enough practice in the corporate world (it reduces helpdesk calls).

very true.  I have problems running my W2K PC as anything but
administrator.  But that is because of bugs in the application
software that I dont have time to deal with. If your enterprise is
serious about security, you have to prevent people from logging in as
administrator.

my working assumption is that a modern windows PC cannot be infected,
hijacked or otherwise hacked if the user is running as a simple user
account.

-Steve