RE: How Secure is Windows, Really?

Application level damage would be easier, but would
require fairly detail knowledge of the application and how it's
configured.  I would guess that this kind of thing would be implemented
by someone on the inside. 

Really?... How about selecting all the tables from systables, then for
each table select all the numeric fields w/decimal positions and then
for each of them execute a sql statement that updates their values to
the effect of (set fld1 = fld1 * 0.01)... Easy to implement w/out any
knowledge of the underlying applications and subtle enough that it
probably wouldn't be noticed until lots of damage had occurred. 

Also, you assume that knowledge of the application would have to come
from the inside. The beauty of packages is that the table names are well
known.

-Walden