RE: How Secure is Windows, Really?

No offense intended but this thread has enough information to jump start
a hacker's knowledge to help hi-jack an iSeries LOL... 


Thanks,
Tommy Holden


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Brian
Sent: Wednesday, January 03, 2007 12:13 PM
To: Midrange Systems Technical Discussion
Subject: Re: How Secure is Windows, Really?

Jim,

My example was not of a backdoor but rather a piece of malware that
was designed for nefarious purposes. This program would not have to
adopt
any authority or use any backdoor access; it would just update more
records
than the user intended for it too but only a little at a time so that it
would be harder to track. Heck, without journaling, it might even
require
several restores to get things back the way they were supposed to be
since
the mischievous changes would be very small and likely remain unnoticed
for
a while.

I think backdoors are fairly common on the System i and are easily
implemented. That's why it's important to have security auditing turned
on
and to pay attention to what programs are adopting authority or
switching
profiles among other things.

Kind regards,

BJ

On 1/3/07, Jim Franz <franz400@xxxxxxxxxxxx> wrote:

Brian>Better yet, how about you create and distribute a freeware

utility

like....

It doesn't take freeware to create a backdoor.
I've seen them in commercial software. Doesn't have to even be

malicious

in it's orginal intent. It's how the executing user uses it....
jim

----- Original Message -----
From: "Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"

<midrange-l@xxxxxxxxxxxx>

Sent: Wednesday, January 03, 2007 12:17 PM
Subject: RE: How Secure is Windows, Really?

Uh... you need a user profile and password to do that.  That's why

it's

a

bad idea to have user profiles and passwords in the wild, and also a

bad

idea to allow SQL access to your machine.

If you're worried thast someone with a valid user profile and

password

will
do this sort of thing, then you better turn off ODBC immediately.

The big difference between iSeries attacks and Windows attacks is

that a

number of the exploits we're talking about on Windows can bypass

Windows

security.  Just like the Rutkowska kernel code injection technique,

they

can
install software beyond the privileges of the user.

All these theoretical attacks on the iSeries require a valid user

profile

and password, as well as the authority to the objects.

Joe

From: Walden H. Leverich

Really?... How about selecting all the tables from systables, then

for

each table select all the numeric fields w/decimal positions and

then

for each of them execute a sql statement that updates their values

to

the effect of (set fld1 = fld1 * 0.01)... Easy to implement w/out

any

knowledge of the underlying applications and subtle enough that it
probably wouldn't be noticed until lots of damage had occurred.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.