New customer of ours had a malware attack. They had a NetServer guest profile and a root directory share. Their only saving grace was the guest profile didn't have *ALLOBJ. Anything that wasn't nailed down got encrypted. We're closing those doors now. And more.

They dodged a howitzer. Keep yourself protected.  https://www.itechsol.com/the-real-effects-of-malware-on-ibm-i/


------------------------------
Steve Pitcher
------------------------------

Ouch, this is bad. 
Is it "just" to restore from backup or is the backups encrypted as well or some malware that just starts encrypting it again after restore?

------------------------------
Torbjörn Appehl
------------------------------

It's a recovery and IFS hardening. It used the guest user ID and the root share to do the damage. Once those doors are shut they're most definitely in better shape than before. Far less risk.

------------------------------
Steve Pitcher
------------------------------

Original Message:
Sent: Wed November 25, 2020 02:17 AM
From: Torbjörn Appehl
Subject: Malware Warning

Ouch, this is bad. 
Is it "just" to restore from backup or is the backups encrypted as well or some malware that just starts encrypting it again after restore?

------------------------------
Torbjörn Appehl
------------------------------

Thanks for the warning.

Jim

------------------------------
James Sparkman
------------------------------

Thank you very much for the timely warning Steve.

It's a great reminder that incorrectly set IFS permissions and broad scope shared folders via NetServer are still a risk that most people overlook, or fail to audit on a regular basis.

------------------------------
Jacob Banda
------------------------------