Rob:
In two cases I've recovered, not all the objects in the QSYS.LIB file system
were altered. While I did not take the time to get counts etc., my memory
is almost every file, and a significant number of other objects were
affected, rendering the partition unable to boot. Once we got the LIC and
QSYS fixed up, to the point of restricted state operations we found most if
not all the applications were clobbered. In the end the partition was
toast, and that's all that mattered. Recovery time.
In other cases where the customer got hit by a malware attack, while the
Microsoft/VMWare environments were completely destroyed, IBM i came away
with at best a flesh wound. Only directories with shares on them were
affected, and we had backup copies stashed that we could use to recover
from.
In all those cases the malware was smart enough to jump across domains, had
access to administrator accounts on servers, and were able to find and
destroy replicated copies of the Microsoft/VMWare environments.
We advise our customers to use virtual tape libraries for all the good
reasons they provide, but also to take specific action to copy critical
backups to tape as an air gap.
We have a sign in the office where the caption reads: "It's not a malware
attack, it's an unscheduled Disaster Recovery test!"
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob
Berendt
Sent: Thursday, June 3, 2021 6:18 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: Encrypting a library
To those who have had to recover from such ransomware attacks: Were
programs also encrypted? Or was it just more 'data' type objects like files
and user spaces?
Let me guess, you were too busy trying to get them back up and running in a
timely fashion to bother with such minutia?
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
