Last Friday, software maker Bytware announced that it had verified that many of its customers had found the mass-email worm Mydoom (also known as Novarg and Mimail.R) residing within email files housed on the customers' iSeries. According to Bytware, these mass-email worms were successfully identified and quarantined by StandGuard Anti-Virus, Bytware's product designed for the iSeries that uses the anti-virus definitions of the McAfee anti-virus product.

Mydoom Attacks Multiply

The first versions of the Mydoom worm were released at the beginning of last week and have spread more rapidly than any previous infection. Mydoom arrives as an attachment that may be one of many different types of file attachments. Mydoom also jumps between network shares and has been transmitted through file-sharing services such as Kazaa. As of Friday, Internet traffic monitors were estimating that as many as one in every three emails transmitted over the Internet were carrying the worm.

The Mydoom package is designed to create a security backdoor in any personal computer running Microsoft Windows software. Once activated, the worm was scheduled to begin a Denial of Service (DoS) attack. Two versions of the worm were identified by Friday--one targeting SCO Group and one targeting Microsoft. Both companies have offered a $250 K bounty for information leading to the arrest and prosecution of the creator(s) of this worm. Both versions also install a Trojan horse key-logging routine that captures keystrokes of security passwords, credit cards, and other potentially important information.

The Bait

Mydoom appears in the user's email box with a variety of different subject lines. Most insidious, it harvests the email addresses of other PC users and sends them multiple official-looking messages that mimic system-generated email server errors. One common message is that the user's email has been rejected by the server, tricking the user to open the infected email.

As a consequence, the Mydoom worm has been labeled the most virulent rogue exploit ever released to date, according to security experts. It has exceeded the speed record of infection set by Sobig.F of 2003. Within several days, the worm had infected an estimated 500,000 PCs in 168 countries.

The iSeries Connection

The appearance of Mydoom on email files stored within the IBM iSeries is not an indication that the iSeries itself is vulnerable to worms and viruses. On the contrary, no known worm or virus has ever been reported to have directly impacted the security of this architecture. Instead, it's an indication that the use of the iSeries as an email and file-serving platform is becoming increasingly common. As with other server platforms, such as Linux and UNIX, the use of the iSeries as an Internet file/mail/application server opens up the potential that it could unwittingly assist in the process of virus or worm infection on PCs that run the Microsoft operating system by acting as a reservoir of infected PC files.

Corporate Security Threatened as a Secondary Target

However, a company's iSeries itself could become a secondary target, as passwords to the server are captured by PCs infected with the worm. This, of course, could include iSeries user IDs and passwords. The worm opens ports on the infected PC, including ports 80, 1080, 3127, 3128, 8080, and 10080 so that a future attacker can gain complete control of the PC and use the information to further attack selected targets. This could allow an infected PC to act as a proxy server for an attack against the information resources of an attached iSeries.

Finally, the Mydoom.B virus--the version aimed to perform a DoS attack on Microsoft on Tuesday, February 3--modifies the Windows registry of the infected PC to disable the functionality of anti-virus software. It also prevents the PC from accessing the security resources of certain anti-virus Web sites. This could prevent the owner of the PC from fixing the problems created by Mydoom, forcing IT to attend and manually disinfect the machine. Since the PC's access to the disinfecting resources of anti-virus Web sites was disabled, the IT personnel will have to individually install one of the many available disinfecting programs available from anti-virus software companies and scan the PC's files. This is a laborious and time-consuming process that can take up to many hours.

How Secure Is the iSeries Site?

As IBM customers continue to implement the advanced integration and consolidation features of the iSeries--features that allow it to serve Web applications, email, and files to network-attached PCs--the greatest threat to the corporation continues to be the presumption by traditional IT that the platform is protected from virus and worm infection. This mimics the attitude of some UNIX administrators that the problems of rogue exploits is limited to--and the responsibility of--Microsoft IT administrators.

However, more and more iSeries administrators are reaching the conclusion that, though the initial targets of virus and worm attacks may be Windows PCs, the integrity of the entire information system must not be allowed to be compromised by the flawed security of any part of the system. Harboring a security threat--in the form of worms, viruses, unsecured password lists, or other files--can result in a serious breach that can heavily cost the organization. The problem is not only that Microsoft Windows products are susceptible, but that the security of the organization as a whole is only as strong as its weakest component.

Consider, for instance, that the amount of time that is required to scan the iSeries IFS for virus and worms by an attached Microsoft Windows computer can take hours, while new mail is continually being added to mailboxes and new infected files are being deposited onto the iSeries. In the space of several hours, worms like Mydoom can impact thousands of accounts, spreading like a plague throughout the company's information system. Certainly, having a capability to scan the IFS with a faster, native facility could help staunch the spread of such exploits.

Bytware's StandGuard Anti-Virus is one native tool in an arsenal of security mechanisms that iSeries IT can now use to shield the iSeries from virus and worm infection. But there will be other substantial challenges ahead for the iSeries that will test the strength of its armor. Certainly, staying on top of the threats will consume an increasing amount of IT's scarce resources. Abandoning the presumption of immunity is the first step.

Thomas M. Stockwell is Editor in Chief of MC Press, LP.