And we are live. All right. We are here in another QA session with Jake LaBelle, talking
about ZOS and surrogate chains. Jake, would you like to tell us a little bit about yourself
and how you got into mainframe hacking?
Hi, I'm Jake. So I guess how I got into it, my company does some jobs in it. I was looking
at some of the reports they wrote and I went, that looks pretty cool. Looked at some pictures
of mainframes and was like, yep, that looks like my type of thing. And yeah, just jumped
right into it. Yeah, it's, I don't know, I think it looks cool. And so I just went
for it.
That's awesome. And I believe this is your first time presenting at DEF CON, correct?
Yep, first time.
So we have a tradition here at DEF CON, whenever you do your first talk, we welcome you onto
the big stage with a drink. This is for contributing content back to the community and answer,
taking the time to answer questions. So cheers to you, Jake. Welcome to DEF CON.
Cheers. I may be a little jealous with filling up my drink though, so...
All right.
Cheers.
Yeah. So we've already got a few questions that have been going through the chat. You kind of
already mentioned like what got you into hacking mainframes. So I'm going to go on to the next one.
Most high security systems, security plans will have periodic audits of rights to make sure the
former super user accounts cannot be taken advantage of. Your talk sort of goes into how
these permissions get chained between users and how they're just sort of left alone.
Do you encounter any of these issues in audits where you're like, you have to remove these
accounts? Or is it pretty much a no-go on touching things?
I guess you'll have like with an audit, you'll have like, for example, okay, well, we don't want to
make some users access this special user, which is basically root. But what about that user which
accesses that user? What about that user which has access to that user? That's not really...
possible to audit. You don't really have the ability to... you don't really have the ability
when you're... well, you probably could, but they probably should, but they don't.
And this... can you use this technique that you had to like... at one point you show like this massive
graph viz graph of nodes. It looks like you were able to fully enumerate all those chains.
Could you extend that into some kind of like security auditing?
Yeah, 100%. So someone else who worked at the company, he made like a tool which...
so this one is more of like a... not an exploitation tool, but like one that you
would use if you didn't have full access. But if you had full access, what you could do is you're
allowed to... you can do what's called unloading the RACF databases, which is all the security.
So you can just take that and then offline you can use that to create all the tools. But this
one's more for... because if you didn't have access, so from your user, what can you access?
But from offline, someone else at the company was making a tool which takes the RACF database,
puts it into any SQL database, and then you can query it however you like.
Well, that sounds handy. Someone else is asking,
ZOS is tied to IBM. Do you think this could be applied to IBM I?
I've never been on a IBM I. I need to be on an IBM I system just to see what it's like, but
I've never actually been on it, so I have no clue what the security is on there.
Fair enough. So I've got to say that my knowledge of mainframes is fairly weak.
When you were at the beginning of your talk, you mentioned a couple... you mentioned partition
datasets versus normal ones as if they were significantly different. Could you
explain what the differences are in those? Yeah, so there's no such thing as folders in
ZOS, so I don't know why, but they like to have a flat file system. So instead of having that,
you have datasets, and then there's just... datasets can have multiple members in them,
so it's kind of like... it acts like a folder, but they're all part of one single file.
So it's... I don't know. It's how they do it. So we think of the partition dataset as kind of
like a file inside of a folder, and the dataset's the folder. Yeah. Yeah. Close enough? Yeah.
Okay, fair enough. When I was going through it, the first thing was like, okay, how do these
correlate to Unix things? And then it was like, wait a minute, nothing correlates. So what am I
doing? That's kind of where I was going to go with. But you did mention the OMVS subsystem,
I believe it was, that is a Unix-like environment. How comfortable would someone that is Linux-centric
feel inside this OMVS environment? It's basically exactly the same. The only thing is that
once you're in that system, you can run anything on the mainframe as well. So you can just say,
you can run a TSO, which is the normal mainframe part, and just go TSO, whatever script you were
going to run in the mainframe thing. So it's exactly the same as any sort of Linux system,
like all the privileges are the same, just you can also, if you have it, you also have access
to that user's mainframe stuff. Okay. Got it, I think. So Jake, do you think your tool could
work on ACF2 or TSS? Again, never been on that. I've only been on a couple of mainframe jobs.
But if it allows surrogate submission, then yeah. So from my kind of understanding of what
surrogates are, it's like a tree of delegated permissions, right? So you get this surrogate
permission for another user, and then you are effectively gaining all the rights of them,
right? So depending on what type of surrogate you give, so the main one is you'll have
user.star in class surrogate, and that means that you can submit a job as user.star,
but there's other type of ones you can have. But a lot of times, if you have surrogate and
one person, you can do all the stuff from that. Like, for example, there's one that I had where
you can, so surrogate, which allows you to write, to do su. But if you can do su, you can run any
TSO command. So it basically means you have full privileges on their thing. Got it. So is it
something that you have to like, generally you have to specifically invoke to get the other user's
permissions? Or do they all just like get wrapped up into... So that's one of the things that why
it required the tool was that you couldn't just... so if user1 had submit on user2, you couldn't
just run user2 stuff. You have to run a job as user2, and that will get returned sometime later.
So that's why the tool was required, is that you can't just run the... you don't have the privileges,
you can submit a job as that user. But yeah. Okay. I actually think that I like literally have
that in my head now. That's awesome. That was really well described.
What are your thoughts on JCL? It's a great language. It's... what am I...
Yeah, it's... it takes a while getting used to, because reading the IBM docs is... it's a skill in itself.
Like, I think I've actually started to... it's really... I don't know if it's something I should
be worried about, but I've actually started to be able to understand IBM documentation, and that's
worrying me. That does sound a little concerning. I'm like, wait, wait, I get it now? But yeah, so it's...
Yeah, so JCL is just a way to submit batch jobs, and yeah.
Is there any kind of like tooling that makes like interacting with that kind of like languages
easier? Or I know that like one of the current hot things is like building languages on top of languages.
So yeah, the writing... like whenever I wrote my programs or any type of thing that I use,
because it's just easier, it's the JCL. I don't really understand how... I don't really understand
how you pass like parameters to it. So I just put it all in like one little REC script, and then it
will just run itself. And then... so REC is like... it's just a scripting language. It's easy to use.
So I just... yeah, that's... yeah, that's right. Yeah, it's just... what is it? JCLs, they just...
there's lots of like programs that it can run that I have no clue what it does. But I know like...
it feels like I now know like what the most important ones do. So that's fine.
I mean, it's probably enough. Like if you know like 75% of most systems, you are very comfortable in that system.
So Jake, have you made any other tools that kind of help to assist with mainframe hacking?
Yeah, so I've got a couple which are varying in their usefulness. So I've got one which is...
so the database for all the security is held. It's just a database. So if you have access...
if you have write access to that, you have access to anything. So I created a quick tool which
if you do have write access to it, it will just insert... it will look for your user, find the special flag
and just turn it to one. So that's a tool which... it's very unlikely that you'll have access to that.
Like that is something that is audited. So it's like, make sure that no one has access to this file.
Because if they do, they have complete access to everything. What other tools? Oh, I made another...
so a SOCKS proxy in REX. So that allows you to... if there's any like...
so for example, if there's any like internal ports you want to hit, or if there's any like...
because everyone trusts the mainframe, so why wouldn't you accept all the firewall stuff from that?
So if there's anything you want to like hit from the mainframe, then there's a SOCKS proxy
which you can just run in REX and then just pass on to any port that you can see from there.
So REX is like... it's not just like a scripting language like bash, which just has like... consumes
a bunch of tools. Like it is like a language. Like it's like fully capable of doing like
hosting network sockets and stuff like that. Yeah, it can do... so REX, you can do anything
you want to do. And there's also a... I don't really understand what the functionality is,
but I know how to use it. So that's like... so if you run... if you write something called address...
so for example, so if you want to write a TSO command, you write address TSO,
and that means that any command you run in quotes runs as TSO. So the way I describe it is
that you can run a program as another program, but I don't even know if that's actually what's
happening. I just know that you can be like address DB2, which is an SQL database in IBM.
And that will then run a command as DB2. So it's a fairly useful language. You can just be like,
this program, I want to run this command. Yeah, it will do it.
Cool. Mainframe is asking, could you talk a little bit more about TK4 and the difference
between ZOS? So TK4 is... it's a beautiful thing. It's an open source mainframe from, well,
for a public domain. I don't know what the actual term, like specific term is, but it's a...
in 1980, they made a mainframe operating system, which is now in the public domain.
And so it made some tools, they made from there, they've created TK4. And TK4 just allows you to
just muck around with, I think I put it in my link in my presentation, but if you want,
just download that, like TK4. You can run it off anything. I found it off a Raspberry Pi,
so it's kind of fun. But yeah, if you want to run like, do like JCLs, you can install
Rex on there. You can install Kix, but also not actually... this was actually one of the things
in my presentation that like, I didn't know how to say, like, so there's something called
Kix with a C, and then something called Kix with a K. And I was trying to say the difference
between them. I was just like, so yeah, on my program, this has Kix, but this has Kix on here.
And I was like, wait a minute, I've just said the same thing twice. But yeah, so K-I-C-X is
a open source. If you want to muck around with Kix on there, which is one of the most, like,
used thing on a mainframe, it's kind of like a web server-ish type of thing. It's...
I don't know. There's no like equivalent to it, kind of. But yeah, if you...
Yeah, TK4 is really good. If you want to just muck around with...
Mainframe bits.
Yeah. And it's completely open source. So muck around with that.
Do you have... Do you know of any, like, good resources for, like, learning how to
use and operate a mainframe? Because it's like coming into it cold, which is like booting up a
Raspberry Pi image seems like...
Yeah, yeah. The best place... Well, the thing is, is that this is 1980s, my mainframe. So even the
IBM docs doesn't tell you what to do, how to do on this. So the kind of two places where it's
the most... So on... There's a Mattermost community called mainframe.community.
Super helpful. If you have any, like, stuff, asking questions on there, we'll get...
We'll actually get questions answers instead of just being like, ask your SME how to do this.
It's like, yeah. So mainframe.community, very good place for if you want to ask just, like, stuff.
But yeah, some other places you might find that your questions don't get answered, but that's good.
What other place? I think... So on my YouTube... There's this person called Moshix on YouTube.
Very, very helpful on, like, TK4, like, how to install these things, how to...
Yeah, how to do a lot of stuff on TK4.
Oh, excellent.
Now, was there anything for your research or even in your presentation that you didn't get to or
that you wanted to look further into that you maybe will look more into in the future? Or
you think it might be good if other people were to try to build upon what you've done?
So... So on the surrogate chains, I've basically just done the... There's the
star.submit privileges and the ppx.serve.star privileges. But, like, there's other surrogate
classes. I don't really know how they work. But if they could all get... If, like... I don't know
how... And also how... If those surrogate classes, other classes, can get you access to everything,
then those should also be added to the program. Like, if that's... If there's, like, a...
Yeah, if there's another surrogate that I've missed, then yeah, that definitely should be
something that should be added. Is your... Have you, like, open sourced a tool? Is that publicly
available at this point? Yeah, on GitHub, I've put my... I think I've... Yeah, I've put my tool.
It's just... Have you actually made it live? Made it public?
I'll... I'll fling it onto the... Into the track chat.
Yeah. Oh, there's lots of chats. I'm very confused about where it is.
Yeah. I'm much of a Discord user, but... Good luck finding it. It is in the DefCon
talk tracks group. And you can either put it in track one... I found it. There you go.
That's... That's one of the things that... When you're on a client call and you can't work out
how the tech works, it's like... Sorry, I'm trying to work out how to get Skype working with my...
With my audio. Please give me 10 minutes to work this out, please.
I am running out of questions. Is there anything in particular that you want to, like, talk about
or advocate for or anything else you want to... Any other areas of interest in the infosec world?
Anything like that? Anything you want to share? I guess there's the thing about, like...
I think a lot of people are like, mainframes? Why mainframes? What's the point of them?
Yeah, it's... So, they do batch jobs incredibly, incredibly efficiently. Like,
people are like, oh, yeah, just go cloud. It's like... Yeah, you don't... When you're trying
to deal with, like, millions of, like, credit card transactions, it may not be the most
cost effective to do it on, like, an AWS instance. That might be pretty expensive.
And also, the other thing where all the code's already in, on a mainframe. So, like,
it's going to be pretty difficult to convert your COBOL code to, I don't know, whatever that you're
trying to convert it to. Yeah. Yeah. Any of the popular languages.
Haka is asking about bricking the mainframe.
I guess... With any of the things that you ever, like, play around with or do,
do you... Is that a concern? Is that something that you have to, like, keep in your mind?
The... There is a thing where, like, on client side that... So, when a web app,
when you're in a testing environment, you're like, okay, I'll just
keep throwing stuff at it. Let's see what happens. Let's see... Yeah, let's just keep
throwing random, like, scripts at it. On a mainframe, you're like, hello, like, person,
I'm testing this on. Can I throw this at this before I, like... I don't want to break your,
like, your massively expensive system. Let's just make sure this is okay first.
Like a major backbone in your organization. Can I just potentially screw it up right now?
Yeah. So, it's... There's also the fun thing is that, like, maybe on, like, a mainframe,
you might... The testing environment may be completely different to the actual, like,
production environment, which is great fun, where you're like, oh, look, I found something.
Is this a thing in your actual, like... No. Okay. Cool. That was a good, like, six hours
looking at that. Great. Thanks. Cool. So, it seems as though that what you're doing
is coming probably even more into demand. I'm seeing where people are looking for people that
can program in COBOL and maintain mainframes. Is this something that you think might be an
area that would be good for people to get into? And if so, if somebody with experience wanted to
make the jump over, what sorts of things could they look into? How could they even get started
in being able to support or test or work with mainframes? So, there is... So, I guess, like,
if you're in, like, a company, you could just shadow a job. That's probably, like... There's
also the... There is a ZOS 1.10 on Pirate Bay, which, of course, I would not be supporting.
You know, piracy is bad and very illegal. Never do that. But if you do have that, that might be useful.
But, yeah. So, who does still use mainframes today? Like, what industries or
major companies, if you can say any, still make use of mainframes?
So, basically, every bank that's big still uses mainframes there. Again, they're doing, like,
massive batch, like, jobs. And they already have all the infrastructure already. So, they're not
gonna... When they're, like, okay, who do we need to go... Do we need to, like... Do we want to move
everything to the cloud? Or do we want to continue on a mainframe? The answer to that question is
they're not going to change their entire system to get... To try and maybe... I don't even know if
it would save money, but maybe. I don't know. And then, I guess, a lot of governments still
use mainframes. Like, for example, I think there was a Freedom of Information request to the UK
government about what mainframes are still in use. And one of the things that really got me was...
So, this was to the people who do, like, the treasury, I think. And so, they were like,
okay, here are the four mainframes that are out of date that we use. And they're, like,
10 years old. And they also say, here are three other mainframes that are managed by Fujitsu that
we use. So, through some research, I'm pretty certain that these are, like, 20-year-old
mainframes that have, like, probably never, ever been looked at ever. They're just running, like...
And I looked at them, and I was like, okay, what are the ones that are running? It's like,
oh, these do all the customs in the UK. Huh. I bet they never want to ever change that shit ever.
They're literally just, like, we're never changing this 20-year-old mainframe that we have.
No one's ever looked at it. It's not even, like, it's not even an IBM mainframe. It's a
special UK mainframe that got bought out by Fujitsu that is now running the customs in
the UK. And I'm like, this has never been looked at. Like, even if a mainframe specialist looked
at it, they wouldn't be able to know anything. It's, like, it's written in this weird language
that I've never heard of. Maybe other people have heard of SCL? I don't know. Have you guys heard of
that? I think that I've come across that in another
DEF CON talk. Maybe. I get exposed to a lot of things. We did have another talk related to past
talks. Cahill says, I've enjoyed various ZOS talks at DEF CON over the last few years, but I never
hear about mainframe security otherwise. Are they a common attack target, or do they tend to go
overlooked because of the foreignness of the platform? What does the defense side look like
outside of the kind of audits you mentioned? I don't actually know, like, the access that...
so it feels like the only people who would actually be able to access this are people
who are fairly, like, sophisticated. You wouldn't have, like, just a random attacker going after a
mainframe, because it's normally, like, hidden in their internal network. So, like, it'd probably
be, like, a nation-state attacker, so, like, or, like, that type of, like, level. So I feel like
if it's an attack, they wouldn't be going after financial stuff, so you wouldn't really ever see
that it was happening, maybe? I don't know. I mean, like, there was the... oh, sorry, yeah.
Oh, sorry, sorry. I mean, so, like, this might have been in us chatting before the actual stream
start, but you did mention that you've, like, you found some mainframes that were just exposed
online just by dropping something into Shodan. So, like, maybe not just a deep internal threat.
Yeah, the majority of the ones I saw on Shodan were, like, there's actually a fun
site that mainframe sent me about all the internet. It's just a bot that you just...
people have sent mainframe IPs to it, and it just goes straight to the picture of the, like,
the initial screen of it. That, I think, is a fairly fun site, but yeah.
But yeah, so there's a couple of government ones, but a lot of them are just, like, emulated ones, but
yeah, I think it's... I think the thing I was going to say was that, like, if a nation-state
ever got a hold of something, it's unlikely they would ever, like, reveal themselves in that way,
that, like, that they had got access to that. Like, it's not, like, a criminal organization
where they'd be trying to, like, go after, like, those type of things. So, that's also a thing where
I don't know if there was in the news recently, the owner of Pirate Bay
hacked a mainframe. It was a while ago, but there's...
I must have missed that one. Yeah, it was...
But how secure are they from the inside? Would it be as simple as just being able to access
somebody's workstation from inside to be able to get to the mainframe?
Mainframe saying it's the Logica breach. Yeah, the Logica breach. And the fun thing about that
one as well is that they released... well, I don't know if they released on purpose,
but all of the, like, the court documents were released. It's on GitHub, by the way.
So, you can see the fun tools they used to, like, to access all the... to do all the stuff.
Mainframe says it's on WikiLeaks. So, anyone out there that's looking for more information...
Apparently, there's a lot more data out there. This sounds pretty fascinating.
Yeah, I was actually writing a tool, and I looked at Logica, and I was like,
wait a minute, they did this already. I got beat out by the hackers.
By a dump of random hacker activity. I love it.
So, you just had to one-up them by presenting at DEF CON.
Yeah. Yeah.
So, we are approaching the end of the time of our QA session. Is there anything else you want
to talk about while you still have the camera? I think I'm all topped out.
Fair enough. Well, thank you very much for doing this Q&A session. Thank you for
presenting to DEF CON, once again, for your first time. Really hope you come back. This
was great content. I need to get back to Vegas at least once.
You've got to experience in-person DEF CON as well.
All right. Well, thank you very much, and we'll talk to you later.