Last Friday, software maker Bytware announced that it had verified that many of its customers had found the mass-email worm Mydoom (also known as Novarg and Mimail.R) residing within email files housed on the customers' iSeries. According to Bytware, these mass-email worms were successfully identified and quarantined by StandGuard Anti-Virus, Bytware's product designed for the iSeries that uses the anti-virus definitions of the McAfee anti-virus product.
Mydoom Attacks Multiply
The first versions of the Mydoom worm were released at the beginning of last week and have spread more rapidly than any previous infection. Mydoom arrives as an attachment that may be one of many different types of file attachments. Mydoom also jumps between network shares and has been transmitted through file-sharing services such as Kazaa. As of Friday, Internet traffic monitors were estimating that as many as one in every three emails transmitted over the Internet were carrying the worm.
The Mydoom package is designed to create a security backdoor in any personal computer running Microsoft Windows software. Once activated, the worm was scheduled to begin a Denial of Service (DoS) attack. Two versions of the worm were identified by Friday--one targeting SCO Group and one targeting Microsoft. Both companies have offered a $250 K bounty for information leading to the arrest and prosecution of the creator(s) of this worm. Both versions also install a Trojan horse key-logging routine that captures keystrokes of security passwords, credit cards, and other potentially important information.
The Bait
Mydoom appears in the user's email box with a variety of different subject lines. Most insidious, it harvests the email addresses of other PC users and sends them multiple official-looking messages that mimic system-generated email server errors. One common message is that the user's email has been rejected by the server, tricking the user to open the infected email.
As a consequence, the Mydoom worm has been labeled the most virulent rogue exploit ever released to date, according to security experts. It has exceeded the speed record of infection set by Sobig.F of 2003. Within several days, the worm had infected an estimated 500,000 PCs in 168 countries.
The iSeries Connection
The appearance of Mydoom on email files stored within the IBM iSeries is not an indication that the iSeries itself is vulnerable to worms and viruses. On the contrary, no known worm or virus has ever been reported to have directly impacted the security of this architecture. Instead, it's an indication that the use of the iSeries as an email and file-serving platform is becoming increasingly common. As with other server platforms, such as Linux and UNIX, the use of the iSeries as an Internet file/mail/application server opens up the potential that it could unwittingly assist in the process of virus or worm infection on PCs that run the Microsoft operating system by acting as a reservoir of infected PC files.
Corporate Security Threatened as a Secondary Target
However, a company's iSeries itself could become a secondary target, as passwords to the server are captured by PCs infected with the worm. This, of course, could include iSeries user IDs and passwords. The worm opens ports on the infected PC, including ports 80, 1080, 3127, 3128, 8080, and 10080 so that a future attacker can gain complete control of the PC and use the information to further attack selected targets. This could allow an infected PC to act as a proxy server for an attack against the information resources of an attached iSeries.
Finally, the Mydoom.B virus--the version aimed to perform a DoS attack on Microsoft on Tuesday, February 3--modifies the Windows registry of the infected PC to disable the functionality of anti-virus software. It also prevents the PC from accessing the security resources of certain anti-virus Web sites. This could prevent the owner of the PC from fixing the problems created by Mydoom, forcing IT to attend and manually disinfect the machine. Since the PC's access to the disinfecting resources of anti-virus Web sites was disabled, the IT personnel will have to individually install one of the many available disinfecting programs available from anti-virus software companies and scan the PC's files. This is a laborious and time-consuming process that can take up to many hours.
How Secure Is the iSeries Site?
As IBM customers continue to implement the advanced integration and consolidation features of the iSeries--features that allow it to serve Web applications, email, and files to network-attached PCs--the greatest threat to the corporation continues to be the presumption by traditional IT that the platform is protected from virus and worm infection. This mimics the attitude of some UNIX administrators that the problems of rogue exploits is limited to--and the responsibility of--Microsoft IT administrators.
However, more and more iSeries administrators are reaching the conclusion that, though the initial targets of virus and worm attacks may be Windows PCs, the integrity of the entire information system must not be allowed to be compromised by the flawed security of any part of the system. Harboring a security threat--in the form of worms, viruses, unsecured password lists, or other files--can result in a serious breach that can heavily cost the organization. The problem is not only that Microsoft Windows products are susceptible, but that the security of the organization as a whole is only as strong as its weakest component.
Consider, for instance, that the amount of time that is required to scan the iSeries IFS for virus and worms by an attached Microsoft Windows computer can take hours, while new mail is continually being added to mailboxes and new infected files are being deposited onto the iSeries. In the space of several hours, worms like Mydoom can impact thousands of accounts, spreading like a plague throughout the company's information system. Certainly, having a capability to scan the IFS with a faster, native facility could help staunch the spread of such exploits.
Bytware's StandGuard Anti-Virus is one native tool in an arsenal of security mechanisms that iSeries IT can now use to shield the iSeries from virus and worm infection. But there will be other substantial challenges ahead for the iSeries that will test the strength of its armor. Certainly, staying on top of the threats will consume an increasing amount of IT's scarce resources. Abandoning the presumption of immunity is the first step.
Thomas M. Stockwell is Editor in Chief of MC Press, LP.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online