Re: VIRUS Alert for the LIST

[Jim Langston <jlangston@xxxxxxxxxxxxxxxx>]

Comments in line.

John Hall wrote:

> Ok now lets think about this.
>
> 1) If a program is NOT a virus but totally disables your system so you
> have to do a scratch install I don't think saying "Well I told you it
> wasn't a virus" will satisfy your boss.

If a program disables your system that you ran, you had better hope
that daily backup you've been running is good and that you don't have
any bad tapes.

Then you need to consider why in the heck did you run it in the first
place?  Trojans are generally worst than viruses.  A virus will usually
keep the system alive long enough to replicate to other systems, a
trojan doesn't care.  A trojan is much worst if you run it, in my opinion.

> 2) Any language that can create an object can replicate itself.  You
> would not need to go beyond CL.  I think you may be considering
> boot-sector viruses on PC's.  That is outdated.  Many PC viruses are
> being written in Word Macro or Excel Macro.  NO prior programming
> experience needed.  Replicate across a network of as400's - no problem
> any of the networking gurus on this list could think of several ways to
> do this.

Replicating to other machines is the key to a virus, not just replicating itself
on the machine it's running on.  5 years ago, an AS/400 virus wouldn't of
been of much effect, maybe one or two machines, and that's it.  But now,
with AS/400s hooking up to the network, to the internet and so on, we
have a real concern on our hands.

> 3) You mention that it would be difficult to achieve in QSYS.LIB - no
> reason to put it in there ?
> of course no problems doing that either.

Lots of ways for a virus to find itself in QSYS.  Too many, in fact.

> 4) I can write that virus in less than a week or Patrick Townsend will
> eat a toad !!! ;)

So could I, and that is sad.  I think I could write a virus for an AS/400 a
lot faster than I could write one for a PC, not that I would do either.

Let's just hope the crackers remain ignorant.

Now I think I know what they mean by "ignorance is bliss".  For us,
anyway, not the ignorant.

Regards,

Jim Langston

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---