1
00:00:14,800 --> 00:00:17,280
And we are live.

2
00:00:17,940 --> 00:00:19,380
All right.

3
00:00:19,380 --> 00:00:28,200
We are here in another QA session with Jake LaBelle, talking about ZOS and surrogate chains.

4
00:00:29,060 --> 00:00:34,580
Jake, would you like to tell us a little bit about yourself and how you got into mainframe hacking?

5
00:00:35,520 --> 00:00:37,880
Hi, I'm Jake.

6
00:00:39,900 --> 00:00:46,520
So I guess how I got into it, my company does some jobs in it.

7
00:00:47,180 --> 00:00:51,420
I was looking at some of the reports they wrote and I went, that looks pretty cool.

8
00:00:51,420 --> 00:00:56,580
Looked at some pictures of mainframes and was like, yep, that looks like my type of thing.

9
00:00:56,580 --> 00:00:59,100
And yeah, just jumped right into it.

10
00:00:59,840 --> 00:01:03,860
Yeah, it's, I don't know, I think it looks cool.

11
00:01:03,860 --> 00:01:05,280
And so I just went for it.

12
00:01:05,280 --> 00:01:06,160
That's awesome.

13
00:01:06,360 --> 00:01:09,940
And I believe this is your first time presenting at DEF CON, correct?

14
00:01:10,260 --> 00:01:11,400
Yep, first time.

15
00:01:11,600 --> 00:01:22,420
So we have a tradition here at DEF CON, whenever you do your first talk, we welcome you onto the big stage with a drink.

16
00:01:23,460 --> 00:01:31,400
This is for contributing content back to the community and answer, taking the time to answer questions.

17
00:01:31,660 --> 00:01:33,820
So cheers to you, Jake.

18
00:01:33,820 --> 00:01:35,220
Welcome to DEF CON.

19
00:01:35,220 --> 00:01:35,740
Cheers .

20
00:01:35,740 --> 00:01:41,760
I may be a little jealous with filling up my drink though, so...

21
00:01:46,390 --> 00:01:47,430
All right.

22
00:01:48,670 --> 00:01:49,870
Cheers.

23
00:01:49,870 --> 00:01:50,490
Yeah.

24
00:01:51,670 --> 00:01:56,690
So we've already got a few questions that have been going through the chat.

25
00:01:56,810 --> 00:02:01,090
You kind of already mentioned like what got you into hacking mainframes.

26
00:02:01,350 --> 00:02:03,690
So I'm going to go on to the next one.

27
00:02:04,190 --> 00:02:11,850
Most high security systems, security plans will have periodic audits of rights to make sure the former super user accounts cannot be taken advantage of.

28
00:02:11,870 --> 00:02:17,750
Your talk sort of goes into how these permissions get chained between users and how they're just sort of left alone.

29
00:02:19,870 --> 00:02:25,150
Do you encounter any of these issues in audits where you're like, you have to remove these accounts?

30
00:02:25,150 --> 00:02:28,930
Or is it pretty much a no-go on touching things?

31
00:02:29,190 --> 00:02:39,050
I guess you'll have like with an audit, you'll have like, for example, okay, well, we don't want to make some users access this special user, which is basically root.

32
00:02:39,250 --> 00:02:42,950
But what about that user which accesses that user?

33
00:02:42,950 --> 00:02:45,690
What about that user which has access to that user?

34
00:02:45,750 --> 00:02:46,930
That's not really...

35
00:02:47,750 --> 00:02:48,810
possible to audit.

36
00:02:48,810 --> 00:02:56,750
You don't really have the ability to... you don't really have the ability when you're... well, you probably could, but they probably should, but they don't.

37
00:02:58,590 --> 00:03:06,850
And this... can you use this technique that you had to like... at one point you show like this massive graph viz graph of nodes.

38
00:03:07,250 --> 00:03:11,690
It looks like you were able to fully enumerate all those chains.

39
00:03:11,830 --> 00:03:15,030
Could you extend that into some kind of like security auditing?

40
00:03:16,490 --> 00:03:17,590
Yeah, 100%.

41
00:03:17,590 --> 00:03:23,630
So someone else who worked at the company, he made like a tool which...

42
00:03:24,630 --> 00:03:33,230
so this one is more of like a... not an exploitation tool, but like one that you would use if you didn't have full access.

43
00:03:33,230 --> 00:03:42,190
But if you had full access, what you could do is you're allowed to... you can do what's called unloading the RACF databases, which is all the security.

44
00:03:42,190 --> 00:03:46,570
So you can just take that and then offline you can use that to create all the tools.

45
00:03:46,570 --> 00:03:53,270
But this one's more for... because if you didn't have access, so from your user, what can you access?

46
00:03:53,270 --> 00:04:03,590
But from offline, someone else at the company was making a tool which takes the RACF database, puts it into any SQL database, and then you can query it however you like.

47
00:04:03,770 --> 00:04:05,470
Well, that sounds handy.

48
00:04:08,310 --> 00:04:11,410
Someone else is asking, ZOS is tied to IBM.

49
00:04:11,410 --> 00:04:13,690
Do you think this could be applied to IBM I?

50
00:04:14,810 --> 00:04:18,050
I've never been on a IBM I.

51
00:04:18,050 --> 00:04:25,410
I need to be on an IBM I system just to see what it's like, but I've never actually been on it, so I have no clue what the security is on there.

52
00:04:26,050 --> 00:04:26,790
Fair enough.

53
00:04:27,870 --> 00:04:33,530
So I've got to say that my knowledge of mainframes is fairly weak.

54
00:04:34,110 --> 00:04:42,410
When you were at the beginning of your talk, you mentioned a couple... you mentioned partition datasets versus normal ones as if they were significantly different.

55
00:04:42,410 --> 00:04:45,410
Could you explain what the differences are in those?

56
00:04:46,490 --> 00:04:55,310
Yeah, so there's no such thing as folders in ZOS, so I don't know why, but they like to have a flat file system.

57
00:04:55,310 --> 00:05:10,830
So instead of having that, you have datasets, and then there's just... datasets can have multiple members in them, so it's kind of like... it acts like a folder, but they're all part of one single file.

58
00:05:11,010 --> 00:05:13,250
So it's... I don't know.

59
00:05:13,250 --> 00:05:16,130
It's how they do it.

60
00:05:16,130 --> 00:05:22,110
So we think of the partition dataset as kind of like a file inside of a folder, and the dataset's the folder.

61
00:05:23,690 --> 00:05:24,230
Yeah.

62
00:05:24,230 --> 00:05:24,650
Yeah.

63
00:05:24,650 --> 00:05:25,430
Close enough?

64
00:05:25,430 --> 00:05:26,010
Yeah.

65
00:05:28,010 --> 00:05:29,630
Okay, fair enough.

66
00:05:30,190 --> 00:05:35,590
When I was going through it, the first thing was like, okay, how do these correlate to Unix things?

67
00:05:35,590 --> 00:05:38,710
And then it was like, wait a minute, nothing correlates.

68
00:05:38,710 --> 00:05:39,870
So what am I doing?

69
00:05:40,030 --> 00:05:42,710
That's kind of where I was going to go with.

70
00:05:42,710 --> 00:05:50,130
But you did mention the OMVS subsystem, I believe it was, that is a Unix-like environment.

71
00:05:50,410 --> 00:05:57,030
How comfortable would someone that is Linux-centric feel inside this OMVS environment?

72
00:05:57,370 --> 00:05:59,270
It's basically exactly the same.

73
00:05:59,270 --> 00:06:04,610
The only thing is that once you're in that system, you can run anything on the mainframe as well.

74
00:06:04,610 --> 00:06:14,190
So you can just say, you can run a TSO, which is the normal mainframe part, and just go TSO, whatever script you were going to run in the mainframe thing.

75
00:06:14,190 --> 00:06:26,570
So it's exactly the same as any sort of Linux system, like all the privileges are the same, just you can also, if you have it, you also have access to that user's mainframe stuff.

76
00:06:27,070 --> 00:06:27,490
Okay.

77
00:06:27,630 --> 00:06:29,490
Got it, I think.

78
00:06:31,550 --> 00:06:37,130
So Jake, do you think your tool could work on ACF2 or TSS?

79
00:06:38,710 --> 00:06:40,270
Again, never been on that.

80
00:06:40,270 --> 00:06:42,030
I've only been on a couple of mainframe jobs.

81
00:06:42,530 --> 00:06:49,410
But if it allows surrogate submission, then yeah.

82
00:06:50,350 --> 00:06:59,150
So from my kind of understanding of what surrogates are, it's like a tree of delegated permissions, right?

83
00:06:59,150 --> 00:07:06,770
So you get this surrogate permission for another user, and then you are effectively gaining all the rights of them, right?

84
00:07:07,350 --> 00:07:23,250
So depending on what type of surrogate you give, so the main one is you'll have user.star in class surrogate, and that means that you can submit a job as user.star, but there's other type of ones you can have.

85
00:07:23,250 --> 00:07:29,310
But a lot of times, if you have surrogate and one person, you can do all the stuff from that.

86
00:07:29,410 --> 00:07:36,610
Like, for example, there's one that I had where you can, so surrogate, which allows you to write, to do su.

87
00:07:36,610 --> 00:07:39,810
But if you can do su, you can run any TSO command.

88
00:07:39,810 --> 00:07:44,970
So it basically means you have full privileges on their thing.

89
00:07:45,190 --> 00:07:45,350
Got it.

90
00:07:45,350 --> 00:07:50,670
So is it something that you have to like, generally you have to specifically invoke to get the other user's permissions?

91
00:07:50,670 --> 00:08:07,870
Or do they all just like get wrapped up into... So that's one of the things that why it required the tool was that you couldn't just... so if user1 had submit on user2, you couldn't just run user2 stuff.

92
00:08:07,870 --> 00:08:13,370
You have to run a job as user2, and that will get returned sometime later.

93
00:08:13,370 --> 00:08:20,590
So that's why the tool was required, is that you can't just run the... you don't have the privileges, you can submit a job as that user.

94
00:08:20,690 --> 00:08:21,430
But yeah.

95
00:08:21,510 --> 00:08:21,790
Okay.

96
00:08:21,790 --> 00:08:25,750
I actually think that I like literally have that in my head now.

97
00:08:25,750 --> 00:08:26,810
That's awesome.

98
00:08:26,810 --> 00:08:28,430
That was really well described.

99
00:08:33,050 --> 00:08:35,850
What are your thoughts on JCL?

100
00:08:36,710 --> 00:08:38,610
It's a great language.

101
00:08:38,650 --> 00:08:40,140
It's... what am I...

102
00:08:41,740 --> 00:08:49,340
Yeah, it's... it takes a while getting used to, because reading the IBM docs is... it's a skill in itself.

103
00:08:49,340 --> 00:08:59,080
Like, I think I've actually started to... it's really... I don't know if it's something I should be worried about, but I've actually started to be able to understand IBM documentation, and that's worrying me.

104
00:08:59,180 --> 00:09:01,100
That does sound a little concerning.

105
00:09:01,240 --> 00:09:04,920
I'm like, wait, wait, I get it now?

106
00:09:04,920 --> 00:09:06,540
But yeah, so it's...

107
00:09:07,520 --> 00:09:12,940
Yeah, so JCL is just a way to submit batch jobs, and yeah.

108
00:09:13,680 --> 00:09:20,280
Is there any kind of like tooling that makes like interacting with that kind of like languages easier?

109
00:09:20,280 --> 00:09:25,680
Or I know that like one of the current hot things is like building languages on top of languages.

110
00:09:27,920 --> 00:09:37,820
So yeah, the writing... like whenever I wrote my programs or any type of thing that I use, because it's just easier, it's the JCL.

111
00:09:37,820 --> 00:09:42,400
I don't really understand how... I don't really understand how you pass like parameters to it.

112
00:09:42,400 --> 00:09:46,920
So I just put it all in like one little REC script, and then it will just run itself.

113
00:09:46,920 --> 00:09:49,720
And then... so REC is like... it's just a scripting language.

114
00:09:49,720 --> 00:09:50,840
It's easy to use.

115
00:09:50,840 --> 00:09:57,160
So I just... yeah, that's... yeah, that's right.

116
00:09:57,160 --> 00:10:00,880
Yeah, it's just... what is it?

117
00:10:01,100 --> 00:10:02,200
JCLs, they just...

118
00:10:02,200 --> 00:10:06,500
there's lots of like programs that it can run that I have no clue what it does.

119
00:10:06,560 --> 00:10:08,620
But I know like...

120
00:10:08,620 --> 00:10:12,080
it feels like I now know like what the most important ones do.

121
00:10:12,080 --> 00:10:13,780
So that's fine.

122
00:10:13,780 --> 00:10:16,440
I mean, it's probably enough.

123
00:10:16,440 --> 00:10:22,560
Like if you know like 75% of most systems, you are very comfortable in that system.

124
00:10:25,360 --> 00:10:30,600
So Jake, have you made any other tools that kind of help to assist with mainframe hacking?

125
00:10:30,600 --> 00:10:37,080
Yeah, so I've got a couple which are varying in their usefulness.

126
00:10:37,080 --> 00:10:40,000
So I've got one which is...

127
00:10:40,820 --> 00:10:43,860
so the database for all the security is held.

128
00:10:43,860 --> 00:10:45,840
It's just a database.

129
00:10:45,840 --> 00:10:47,620
So if you have access...

130
00:10:47,620 --> 00:10:50,800
if you have write access to that, you have access to anything.

131
00:10:50,800 --> 00:11:01,520
So I created a quick tool which if you do have write access to it, it will just insert... it will look for your user, find the special flag and just turn it to one.

132
00:11:01,840 --> 00:11:06,680
So that's a tool which... it's very unlikely that you'll have access to that.

133
00:11:06,680 --> 00:11:08,080
Like that is something that is audited.

134
00:11:08,080 --> 00:11:10,700
So it's like, make sure that no one has access to this file.

135
00:11:10,700 --> 00:11:13,640
Because if they do, they have complete access to everything.

136
00:11:15,240 --> 00:11:16,100
What other tools?

137
00:11:16,100 --> 00:11:16,680
Oh, I made another...

138
00:11:18,540 --> 00:11:21,320
so a SOCKS proxy in REX.

139
00:11:21,460 --> 00:11:23,680
So that allows you to... if there's any like...

140
00:11:25,860 --> 00:11:30,640
so for example, if there's any like internal ports you want to hit, or if there's any like...

141
00:11:31,440 --> 00:11:36,500
because everyone trusts the mainframe, so why wouldn't you accept all the firewall stuff from that?

142
00:11:36,500 --> 00:11:48,040
So if there's anything you want to like hit from the mainframe, then there's a SOCKS proxy which you can just run in REX and then just pass on to any port that you can see from there.

143
00:11:48,040 --> 00:11:55,160
So REX is like... it's not just like a scripting language like bash, which just has like... consumes a bunch of tools.

144
00:11:55,160 --> 00:11:56,920
Like it is like a language.

145
00:11:56,920 --> 00:12:03,040
Like it's like fully capable of doing like hosting network sockets and stuff like that.

146
00:12:03,440 --> 00:12:06,580
Yeah, it can do... so REX, you can do anything you want to do.

147
00:12:06,580 --> 00:12:10,720
And there's also a... I don't really understand what the functionality is, but I know how to use it.

148
00:12:10,720 --> 00:12:14,300
So that's like... so if you run... if you write something called address...

149
00:12:14,300 --> 00:12:24,880
so for example, so if you want to write a TSO command, you write address TSO, and that means that any command you run in quotes runs as TSO.

150
00:12:25,100 --> 00:12:30,500
So the way I describe it is that you can run a program as another program, but I don't even know if that's actually what's happening.

151
00:12:30,500 --> 00:12:38,920
I just know that you can be like address DB2, which is an SQL database in IBM.

152
00:12:38,920 --> 00:12:43,340
And that will then run a command as DB2.

153
00:12:43,340 --> 00:12:46,620
So it's a fairly useful language.

154
00:12:46,620 --> 00:12:51,280
You can just be like, this program, I want to run this command.

155
00:12:51,500 --> 00:12:53,120
Yeah, it will do it.

156
00:12:53,480 --> 00:12:54,560
Cool.

157
00:12:54,660 --> 00:13:00,940
Mainframe is asking, could you talk a little bit more about TK4 and the difference between ZOS?

158
00:13:02,640 --> 00:13:08,800
So TK4 is... it's a beautiful thing.

159
00:13:08,800 --> 00:13:15,740
It's an open source mainframe from, well, for a public domain.

160
00:13:15,740 --> 00:13:18,600
I don't know what the actual term, like specific term is, but it's a...

161
00:13:19,160 --> 00:13:24,120
in 1980, they made a mainframe operating system, which is now in the public domain.

162
00:13:24,760 --> 00:13:29,440
And so it made some tools, they made from there, they've created TK4.

163
00:13:29,880 --> 00:13:41,500
And TK4 just allows you to just muck around with, I think I put it in my link in my presentation, but if you want, just download that, like TK4.

164
00:13:41,500 --> 00:13:43,220
You can run it off anything.

165
00:13:43,220 --> 00:13:46,300
I found it off a Raspberry Pi, so it's kind of fun.

166
00:13:46,620 --> 00:13:55,780
But yeah, if you want to run like, do like JCLs, you can install Rex on there.

167
00:13:55,800 --> 00:14:07,860
You can install Kix, but also not actually... this was actually one of the things in my presentation that like, I didn't know how to say, like, so there's something called Kix with a C, and then something called Kix with a K.

168
00:14:07,860 --> 00:14:09,860
And I was trying to say the difference between them.

169
00:14:09,860 --> 00:14:14,340
I was just like, so yeah, on my program, this has Kix, but this has Kix on here.

170
00:14:14,340 --> 00:14:17,620
And I was like, wait a minute, I've just said the same thing twice.

171
00:14:17,980 --> 00:14:23,400
But yeah, so K-I-C-X is a open source.

172
00:14:23,400 --> 00:14:32,760
If you want to muck around with Kix on there, which is one of the most, like, used thing on a mainframe, it's kind of like a web server-ish type of thing.

173
00:14:33,460 --> 00:14:33,860
It's...

174
00:14:33,860 --> 00:14:35,120
I don't know.

175
00:14:35,120 --> 00:14:37,200
There's no like equivalent to it, kind of.

176
00:14:37,200 --> 00:14:37,940
But yeah, if you...

177
00:14:40,700 --> 00:14:42,280
Yeah, TK4 is really good.

178
00:14:42,280 --> 00:14:43,300
If you want to just muck around with...

179
00:14:44,140 --> 00:14:45,260
Mainframe bits.

180
00:14:45,680 --> 00:14:46,040
Yeah.

181
00:14:46,040 --> 00:14:47,960
And it's completely open source.

182
00:14:47,960 --> 00:14:49,500
So muck around with that.

183
00:14:50,180 --> 00:14:56,220
Do you have... Do you know of any, like, good resources for, like, learning how to use and operate a mainframe?

184
00:14:56,540 --> 00:15:07,040
Because it's like coming into it cold, which is like booting up a Raspberry Pi image seems like... Yeah , yeah.

185
00:15:07,040 --> 00:15:11,320
The best place... Well, the thing is, is that this is 1980s, my mainframe.

186
00:15:11,320 --> 00:15:14,260
So even the IBM docs doesn't tell you what to do, how to do on this.

187
00:15:14,260 --> 00:15:24,980
So the kind of two places where it's the most... So on... There's a Mattermost community called mainframe.community.

188
00:15:25,740 --> 00:15:27,020
Super helpful.

189
00:15:27,020 --> 00:15:30,200
If you have any, like, stuff, asking questions on there, we'll get...

190
00:15:31,120 --> 00:15:38,140
We'll actually get questions answers instead of just being like, ask your SME how to do this.

191
00:15:38,140 --> 00:15:38,980
It's like, yeah.

192
00:15:38,980 --> 00:15:43,240
So mainframe.community, very good place for if you want to ask just, like, stuff.

193
00:15:43,240 --> 00:15:49,920
But yeah, some other places you might find that your questions don't get answered, but that's good.

194
00:15:50,780 --> 00:15:52,280
What other place?

195
00:15:53,460 --> 00:16:00,200
I think... So on my YouTube... There's this person called Moshix on YouTube.

196
00:16:00,560 --> 00:16:04,320
Very, very helpful on, like, TK4, like, how to install these things, how to...

197
00:16:05,460 --> 00:16:08,720
Yeah, how to do a lot of stuff on TK4.

198
00:16:09,600 --> 00:16:11,080
Oh, excellent.

199
00:16:11,600 --> 00:16:23,840
Now, was there anything for your research or even in your presentation that you didn't get to or that you wanted to look further into that you maybe will look more into in the future?

200
00:16:23,840 --> 00:16:29,180
Or you think it might be good if other people were to try to build upon what you've done?

201
00:16:33,100 --> 00:16:42,680
So... So on the surrogate chains, I've basically just done the... There's the star.submit privileges and the ppx.serve.star privileges.

202
00:16:42,680 --> 00:16:45,560
But, like, there's other surrogate classes.

203
00:16:45,620 --> 00:16:47,520
I don't really know how they work.

204
00:16:47,580 --> 00:16:58,100
But if they could all get... If, like... I don't know how... And also how... If those surrogate classes, other classes, can get you access to everything, then those should also be added to the program.

205
00:16:58,100 --> 00:16:59,940
Like, if that's... If there's, like, a...

206
00:17:02,120 --> 00:17:08,080
Yeah, if there's another surrogate that I've missed, then yeah, that definitely should be something that should be added.

207
00:17:08,100 --> 00:17:10,800
Is your... Have you, like, open sourced a tool?

208
00:17:10,800 --> 00:17:12,480
Is that publicly available at this point?

209
00:17:12,480 --> 00:17:17,760
Yeah, on GitHub, I've put my... I think I've... Yeah, I've put my tool.

210
00:17:17,760 --> 00:17:20,240
It's just... Have you actually made it live?

211
00:17:20,240 --> 00:17:21,080
Made it public?

212
00:17:26,930 --> 00:17:31,410
I'll... I'll fling it onto the... Into the track chat.

213
00:17:31,890 --> 00:17:32,630
Yeah.

214
00:17:36,530 --> 00:17:38,210
Oh, there's lots of chats.

215
00:17:38,210 --> 00:17:40,210
I'm very confused about where it is.

216
00:17:40,270 --> 00:17:40,850
Yeah.

217
00:17:40,850 --> 00:17:44,070
I'm much of a Discord user, but... Good luck finding it.

218
00:17:44,070 --> 00:17:46,370
It is in the DefCon talk tracks group.

219
00:17:46,410 --> 00:17:49,010
And you can either put it in track one... I found it.

220
00:17:49,010 --> 00:17:49,850
There you go.

221
00:17:53,190 --> 00:18:03,210
That's... That's one of the things that... When you're on a client call and you can't work out how the tech works, it's like... Sorry, I'm trying to work out how to get Skype working with my...

222
00:18:03,210 --> 00:18:04,310
With my audio.

223
00:18:04,310 --> 00:18:07,110
Please give me 10 minutes to work this out, please.

224
00:18:12,780 --> 00:18:15,020
I am running out of questions.

225
00:18:15,020 --> 00:18:25,140
Is there anything in particular that you want to, like, talk about or advocate for or anything else you want to... Any other areas of interest in the infosec world?

226
00:18:25,140 --> 00:18:25,900
Anything like that?

227
00:18:25,900 --> 00:18:27,020
Anything you want to share?

228
00:18:30,800 --> 00:18:33,160
I guess there's the thing about, like...

229
00:18:33,160 --> 00:18:36,140
I think a lot of people are like, mainframes?

230
00:18:36,680 --> 00:18:37,920
Why mainframes?

231
00:18:37,920 --> 00:18:39,280
What's the point of them?

232
00:18:39,840 --> 00:18:47,840
Yeah, it's... So, they do batch jobs incredibly, incredibly efficiently.

233
00:18:47,860 --> 00:18:50,340
Like, people are like, oh, yeah, just go cloud.

234
00:18:50,340 --> 00:19:05,960
It's like... Yeah, you don't... When you're trying to deal with, like, millions of, like, credit card transactions, it may not be the most cost effective to do it on, like, an AWS instance.

235
00:19:05,960 --> 00:19:07,920
That might be pretty expensive.

236
00:19:08,240 --> 00:19:12,600
And also, the other thing where all the code's already in, on a mainframe.

237
00:19:12,600 --> 00:19:21,860
So, like, it's going to be pretty difficult to convert your COBOL code to, I don't know, whatever that you're trying to convert it to.

238
00:19:21,860 --> 00:19:22,400
Yeah.

239
00:19:22,420 --> 00:19:22,420
Yeah.

240
00:19:22,620 --> 00:19:24,940
Any of the popular languages.

241
00:19:27,620 --> 00:19:31,160
Haka is asking about bricking the mainframe.

242
00:19:35,240 --> 00:19:41,180
I guess... With any of the things that you ever, like, play around with or do, do you... Is that a concern?

243
00:19:41,180 --> 00:19:44,040
Is that something that you have to, like, keep in your mind?

244
00:19:46,260 --> 00:19:56,680
The... There is a thing where, like, on client side that... So, when a web app, when you're in a testing environment, you're like, okay, I'll just keep throwing stuff at it.

245
00:19:56,680 --> 00:19:57,820
Let's see what happens.

246
00:19:57,820 --> 00:20:03,120
Let's see... Yeah, let's just keep throwing random, like, scripts at it.

247
00:20:03,120 --> 00:20:07,920
On a mainframe, you're like, hello, like, person, I'm testing this on.

248
00:20:07,920 --> 00:20:14,420
Can I throw this at this before I, like... I don't want to break your, like, your massively expensive system.

249
00:20:15,060 --> 00:20:17,560
Let's just make sure this is okay first.

250
00:20:17,560 --> 00:20:21,120
Like a major backbone in your organization.

251
00:20:21,140 --> 00:20:24,700
Can I just potentially screw it up right now?

252
00:20:26,500 --> 00:20:27,160
Yeah.

253
00:20:27,160 --> 00:20:52,740
So, it's... There's also the fun thing is that, like, maybe on, like, a mainframe, you might... The testing environment may be completely different to the actual, like, production environment, which is great fun, where you're like, oh, look, I found something.

254
00:20:52,740 --> 00:20:55,940
Is this a thing in your actual, like... No.

255
00:20:55,940 --> 00:20:56,400
Okay.

256
00:20:56,400 --> 00:20:56,860
Cool.

257
00:20:56,860 --> 00:21:00,480
That was a good, like, six hours looking at that.

258
00:21:00,480 --> 00:21:00,700
Great.

259
00:21:00,700 --> 00:21:01,600
Thanks.

260
00:21:01,660 --> 00:21:02,740
Cool.

261
00:21:05,100 --> 00:21:12,400
So, it seems as though that what you're doing is coming probably even more into demand.

262
00:21:12,400 --> 00:21:18,380
I'm seeing where people are looking for people that can program in COBOL and maintain mainframes.

263
00:21:18,380 --> 00:21:23,220
Is this something that you think might be an area that would be good for people to get into?

264
00:21:23,220 --> 00:21:28,740
And if so, if somebody with experience wanted to make the jump over, what sorts of things could they look into?

265
00:21:28,740 --> 00:21:34,280
How could they even get started in being able to support or test or work with mainframes?

266
00:21:35,060 --> 00:21:44,900
So, there is... So, I guess, like, if you're in, like, a company, you could just shadow a job.

267
00:21:44,940 --> 00:21:55,020
That's probably, like... There's also the... There is a ZOS 1.10 on Pirate Bay, which, of course, I would not be supporting.

268
00:21:55,020 --> 00:21:57,120
You know, piracy is bad and very illegal.

269
00:21:57,120 --> 00:21:58,700
Never do that.

270
00:21:58,840 --> 00:22:01,820
But if you do have that, that might be useful.

271
00:22:02,520 --> 00:22:03,120
But, yeah.

272
00:22:03,120 --> 00:22:08,000
So, who does still use mainframes today?

273
00:22:08,000 --> 00:22:14,520
Like, what industries or major companies, if you can say any, still make use of mainframes?

274
00:22:15,080 --> 00:22:21,060
So, basically, every bank that's big still uses mainframes there.

275
00:22:21,500 --> 00:22:24,700
Again, they're doing, like, massive batch, like, jobs.

276
00:22:24,940 --> 00:22:26,880
And they already have all the infrastructure already.

277
00:22:26,880 --> 00:22:32,540
So, they're not gonna... When they're, like, okay, who do we need to go... Do we need to, like... Do we want to move everything to the cloud?

278
00:22:32,540 --> 00:22:34,860
Or do we want to continue on a mainframe?

279
00:22:35,680 --> 00:22:45,780
The answer to that question is they're not going to change their entire system to get... To try and maybe... I don't even know if it would save money, but maybe.

280
00:22:45,780 --> 00:22:46,660
I don't know.

281
00:22:47,060 --> 00:22:52,220
And then, I guess, a lot of governments still use mainframes.

282
00:22:52,220 --> 00:23:00,120
Like, for example, I think there was a Freedom of Information request to the UK government about what mainframes are still in use.

283
00:23:00,120 --> 00:23:02,620
And one of the things that really got me was...

284
00:23:02,620 --> 00:23:10,140
So, this was to the people who do, like, the treasury, I think.

285
00:23:10,500 --> 00:23:15,320
And so, they were like, okay, here are the four mainframes that are out of date that we use.

286
00:23:15,320 --> 00:23:17,860
And they're, like, 10 years old.

287
00:23:18,060 --> 00:23:24,360
And they also say, here are three other mainframes that are managed by Fujitsu that we use.

288
00:23:25,220 --> 00:23:34,300
So, through some research, I'm pretty certain that these are, like, 20-year-old mainframes that have, like, probably never, ever been looked at ever.

289
00:23:34,420 --> 00:23:36,980
They're just running, like...

290
00:23:36,980 --> 00:23:39,200
And I looked at them, and I was like, okay, what are the ones that are running?

291
00:23:39,200 --> 00:23:41,980
It's like, oh, these do all the customs in the UK.

292
00:23:42,500 --> 00:23:43,180
Huh.

293
00:23:43,360 --> 00:23:45,900
I bet they never want to ever change that shit ever.

294
00:23:45,940 --> 00:23:50,640
They're literally just, like, we're never changing this 20-year-old mainframe that we have.

295
00:23:51,040 --> 00:23:52,180
No one's ever looked at it.

296
00:23:52,180 --> 00:23:55,520
It's not even, like, it's not even an IBM mainframe.

297
00:23:55,520 --> 00:24:03,260
It's a special UK mainframe that got bought out by Fujitsu that is now running the customs in the UK.

298
00:24:03,260 --> 00:24:06,040
And I'm like, this has never been looked at.

299
00:24:07,300 --> 00:24:11,480
Like, even if a mainframe specialist looked at it, they wouldn't be able to know anything.

300
00:24:11,480 --> 00:24:16,620
It's, like, it's written in this weird language that I've never heard of.

301
00:24:16,620 --> 00:24:18,720
Maybe other people have heard of SCL?

302
00:24:18,780 --> 00:24:19,260
I don't know.

303
00:24:19,260 --> 00:24:20,160
Have you guys heard of that?

304
00:24:20,160 --> 00:24:25,600
I think that I've come across that in another DEF CON talk.

305
00:24:26,040 --> 00:24:26,480
Maybe.

306
00:24:26,960 --> 00:24:29,240
I get exposed to a lot of things.

307
00:24:31,800 --> 00:24:37,340
We did have another talk related to past talks.

308
00:24:38,140 --> 00:24:45,460
Cahill says, I've enjoyed various ZOS talks at DEF CON over the last few years, but I never hear about mainframe security otherwise.

309
00:24:45,460 --> 00:24:50,700
Are they a common attack target, or do they tend to go overlooked because of the foreignness of the platform?

310
00:24:50,700 --> 00:24:54,240
What does the defense side look like outside of the kind of audits you mentioned?

311
00:24:55,480 --> 00:24:57,760
I don't actually know, like, the access that...

312
00:24:59,020 --> 00:25:08,000
so it feels like the only people who would actually be able to access this are people who are fairly, like, sophisticated.

313
00:25:08,000 --> 00:25:15,800
You wouldn't have, like, just a random attacker going after a mainframe , because it's normally, like, hidden in their internal network.

314
00:25:15,800 --> 00:25:22,120
So, like, it'd probably be, like, a nation-state attacker, so, like, or, like, that type of, like, level.

315
00:25:22,140 --> 00:25:30,740
So I feel like if it's an attack, they wouldn't be going after financial stuff, so you wouldn't really ever see that it was happening, maybe?

316
00:25:30,740 --> 00:25:31,620
I don't know.

317
00:25:31,700 --> 00:25:35,680
I mean, like, there was the... oh, sorry, yeah.

318
00:25:35,680 --> 00:25:36,500
Oh, sorry, sorry.

319
00:25:36,500 --> 00:25:49,660
I mean, so, like, this might have been in us chatting before the actual stream start, but you did mention that you've, like, you found some mainframes that were just exposed online just by dropping something into Shodan.

320
00:25:49,880 --> 00:25:54,960
So, like, maybe not just a deep internal threat.

321
00:25:56,240 --> 00:26:09,340
Yeah, the majority of the ones I saw on Shodan were, like, there's actually a fun site that mainframe sent me about all the internet.

322
00:26:09,340 --> 00:26:12,180
It's just a bot that you just...

323
00:26:12,180 --> 00:26:18,800
people have sent mainframe IPs to it, and it just goes straight to the picture of the, like, the initial screen of it.

324
00:26:18,800 --> 00:26:24,920
That, I think, is a fairly fun site, but yeah.

325
00:26:26,200 --> 00:26:46,780
But yeah, so there's a couple of government ones, but a lot of them are just, like, emulated ones, but yeah, I think it's... I think the thing I was going to say was that, like, if a nation-state ever got a hold of something, it's unlikely they would ever,

326
00:26:46,780 --> 00:26:51,880
like, reveal themselves in that way, that, like, that they had got access to that.

327
00:26:51,880 --> 00:26:57,900
Like, it's not, like, a criminal organization where they'd be trying to, like, go after, like, those type of things.

328
00:26:57,900 --> 00:27:08,200
So, that's also a thing where I don't know if there was in the news recently, the owner of Pirate Bay hacked a mainframe.

329
00:27:08,200 --> 00:27:09,780
It was a while ago, but there's...

330
00:27:11,580 --> 00:27:13,240
I must have missed that one.

331
00:27:13,520 --> 00:27:15,820
Yeah, it was...

332
00:27:16,940 --> 00:27:19,300
But how secure are they from the inside?

333
00:27:19,300 --> 00:27:26,420
Would it be as simple as just being able to access somebody's workstation from inside to be able to get to the mainframe?

334
00:27:26,420 --> 00:27:28,740
Mainframe saying it's the Logica breach.

335
00:27:29,260 --> 00:27:30,300
Yeah, the Logica breach.

336
00:27:30,300 --> 00:27:38,060
And the fun thing about that one as well is that they released... well, I don't know if they released on purpose, but all of the, like, the court documents were released.

337
00:27:38,060 --> 00:27:39,500
It's on GitHub, by the way.

338
00:27:39,500 --> 00:27:45,840
So, you can see the fun tools they used to, like, to access all the... to do all the stuff.

339
00:27:48,000 --> 00:27:49,980
Mainframe says it's on WikiLeaks.

340
00:27:49,980 --> 00:27:52,020
So, anyone out there that's looking for more information...

341
00:27:54,460 --> 00:27:56,780
Apparently, there's a lot more data out there.

342
00:27:57,680 --> 00:27:59,500
This sounds pretty fascinating.

343
00:28:00,560 --> 00:28:07,960
Yeah, I was actually writing a tool, and I looked at Logica, and I was like, wait a minute, they did this already.

344
00:28:08,260 --> 00:28:13,440
I got beat out by the hackers.

345
00:28:13,440 --> 00:28:16,820
By a dump of random hacker activity.

346
00:28:16,820 --> 00:28:17,740
I love it.

347
00:28:18,440 --> 00:28:21,040
So, you just had to one-up them by presenting at DEF CON.

348
00:28:21,700 --> 00:28:22,500
Yeah.

349
00:28:23,260 --> 00:28:23,840
Yeah.

350
00:28:24,800 --> 00:28:28,500
So, we are approaching the end of the time of our QA session.

351
00:28:28,500 --> 00:28:31,940
Is there anything else you want to talk about while you still have the camera?

352
00:28:35,160 --> 00:28:38,100
I think I'm all topped out.

353
00:28:40,200 --> 00:28:41,000
Fair enough.

354
00:28:41,000 --> 00:28:43,640
Well, thank you very much for doing this Q&A session.

355
00:28:43,640 --> 00:28:47,020
Thank you for presenting to DEF CON, once again, for your first time.

356
00:28:47,020 --> 00:28:48,280
Really hope you come back.

357
00:28:48,280 --> 00:28:49,780
This was great content.

358
00:28:50,320 --> 00:28:53,840
I need to get back to Vegas at least once.

359
00:28:54,000 --> 00:28:57,400
You've got to experience in-person DEF CON as well.

360
00:28:58,580 --> 00:28:59,320
All right.

361
00:28:59,320 --> 00:29:02,800
Well, thank you very much, and we'll talk to you later.