RE: How Secure is Windows, Really?

From: Scott Klement

While technically that's true ... it's a lot harder to do on the System
i than it is on a PC.

Some parts are harder, others are easier.  The ability to insert your
program as a CPP, VCP, etc for *CMD objects on the system, plus the
ability to arbitrarily assign exit programs where nobody ever sees them
run, makes it very easy to write a virus that spreads on the system
itself.  Much easier than it is on Windows.

This is NOT a virus.  Getting a program to execute without the user's
explicit intent is at best a Trojan horse, and as long as you have the
ability to alter the runtime environment, you can do this ON ANY SYSTEM.

There is no reason that a non-programmer should be able to do any of the
things you mention, Scott, and not only that, in properly secured
environments no programmer should be able to do that in production.

So, no, it's not easier to create a Trojan on an iSeries.  If you have admin
rights on a Windows box, you can create a Trojan just as easily.  Hell, as
you yourself pointed out, just change a registry entry and you can load your
program when the user double-clicks a document.

Making it spread from system to system, however, is more difficult.  But
certainly not impossible.  You're correct that you can't simply transfer a
*PGM object from one system to another, you have to stick it in a
save file and restore that save file, etc.  However, nothing stops you
from simply writing a PASE program. Or QShell script.  Or Java class
object. Or REXX procedure. Or OCL procedure.  Anything that executes from
a normal stream file or file member (instead of a *PGM object) can be
freely distributed this way.

Yeah, but who in their right mind runs PASE objects or scripts on their
iSeries without knowing what they do?  I'll grant you that there is a
certain new generation of developers who will run just about anything on
their machine, but those people are idiots.  And if you do that with your
mission critical business server, you just plain deserve to be fired.

Heck, even the Open Source community is smarter than that: that's why there
are MD5 checksums on distribution packages.  If you run a non-trusted
application on your machine with ANY sort of administration rights, you get
everything you deserve.

Naturally, those things I listed above can be used to create native *PGM
objects, if so desired.

The hell they can, unless the user has authority to SAVRST or CRTxxx
commands.  And only a programmer or an admin should have those rights and
they shouldn't be running things they don't understand.  I don't get this
line of reasoning at all...

But, still...  You could write a virus that would search out other systems
on the Internet, and using SMB (/QNTC) could try to insert your program.
Your program could then create some *PGM objects that inserted themselves
into the system all over the place, and continued to use /QNTC to spread
across the Internet... all very possible.

Scott, my website is hosted on an iSeries.  If you can insert a program on
that iSeries via the Internet, I will give you $1000.  Until then, I insist
that the iSeries is more secure than Windows.

It's not even close.

Joe