start	end	text
14800	23940	And we are live. All right. We are here in another QA session with Jake LaBelle, talking
23940	31580	about ZOS and surrogate chains. Jake, would you like to tell us a little bit about yourself
31580	34580	and how you got into mainframe hacking?
35520	48680	Hi, I'm Jake. So I guess how I got into it, my company does some jobs in it. I was looking
48680	52240	at some of the reports they wrote and I went, that looks pretty cool. Looked at some pictures
52240	58000	of mainframes and was like, yep, that looks like my type of thing. And yeah, just jumped
58000	64660	right into it. Yeah, it's, I don't know, I think it looks cool. And so I just went
64660	65280	for it.
65280	69940	That's awesome. And I believe this is your first time presenting at DEF CON, correct?
70260	71400	Yep, first time.
71600	79060	So we have a tradition here at DEF CON, whenever you do your first talk, we welcome you onto
79060	89380	the big stage with a drink. This is for contributing content back to the community and answer,
89380	95220	taking the time to answer questions. So cheers to you, Jake. Welcome to DEF CON.
95220	101760	Cheers. I may be a little jealous with filling up my drink though, so...
106390	107430	All right.
108670	109870	Cheers.
109870	117430	Yeah. So we've already got a few questions that have been going through the chat. You kind of
118030	123690	already mentioned like what got you into hacking mainframes. So I'm going to go on to the next one.
124190	129270	Most high security systems, security plans will have periodic audits of rights to make sure the
129270	133510	former super user accounts cannot be taken advantage of. Your talk sort of goes into how
133510	137750	these permissions get chained between users and how they're just sort of left alone.
139870	144570	Do you encounter any of these issues in audits where you're like, you have to remove these
144570	148930	accounts? Or is it pretty much a no-go on touching things?
149190	154050	I guess you'll have like with an audit, you'll have like, for example, okay, well, we don't want to
154050	161650	make some users access this special user, which is basically root. But what about that user which
161650	166930	accesses that user? What about that user which has access to that user? That's not really...
167750	172950	possible to audit. You don't really have the ability to... you don't really have the ability
172950	176750	when you're... well, you probably could, but they probably should, but they don't.
178590	184630	And this... can you use this technique that you had to like... at one point you show like this massive
184630	191690	graph viz graph of nodes. It looks like you were able to fully enumerate all those chains.
191830	195030	Could you extend that into some kind of like security auditing?
196490	203630	Yeah, 100%. So someone else who worked at the company, he made like a tool which...
204630	211250	so this one is more of like a... not an exploitation tool, but like one that you
211250	215710	would use if you didn't have full access. But if you had full access, what you could do is you're
215710	222190	allowed to... you can do what's called unloading the RACF databases, which is all the security.
222190	226730	So you can just take that and then offline you can use that to create all the tools. But this
226730	233270	one's more for... because if you didn't have access, so from your user, what can you access?
233270	239810	But from offline, someone else at the company was making a tool which takes the RACF database,
239810	243590	puts it into any SQL database, and then you can query it however you like.
243770	249710	Well, that sounds handy. Someone else is asking,
249710	253690	ZOS is tied to IBM. Do you think this could be applied to IBM I?
254810	261430	I've never been on a IBM I. I need to be on an IBM I system just to see what it's like, but
261430	265410	I've never actually been on it, so I have no clue what the security is on there.
266050	273530	Fair enough. So I've got to say that my knowledge of mainframes is fairly weak.
274110	278630	When you were at the beginning of your talk, you mentioned a couple... you mentioned partition
278630	282690	datasets versus normal ones as if they were significantly different. Could you
282690	290630	explain what the differences are in those? Yeah, so there's no such thing as folders in
290630	296230	ZOS, so I don't know why, but they like to have a flat file system. So instead of having that,
296230	305510	you have datasets, and then there's just... datasets can have multiple members in them,
305510	310830	so it's kind of like... it acts like a folder, but they're all part of one single file.
311010	318930	So it's... I don't know. It's how they do it. So we think of the partition dataset as kind of
318930	326010	like a file inside of a folder, and the dataset's the folder. Yeah. Yeah. Close enough? Yeah.
328010	333170	Okay, fair enough. When I was going through it, the first thing was like, okay, how do these
333170	339150	correlate to Unix things? And then it was like, wait a minute, nothing correlates. So what am I
339150	346690	doing? That's kind of where I was going to go with. But you did mention the OMVS subsystem,
346690	354190	I believe it was, that is a Unix-like environment. How comfortable would someone that is Linux-centric
354190	360150	feel inside this OMVS environment? It's basically exactly the same. The only thing is that
360150	365730	once you're in that system, you can run anything on the mainframe as well. So you can just say,
365730	373030	you can run a TSO, which is the normal mainframe part, and just go TSO, whatever script you were
373030	377750	going to run in the mainframe thing. So it's exactly the same as any sort of Linux system,
377750	384490	like all the privileges are the same, just you can also, if you have it, you also have access
384490	394410	to that user's mainframe stuff. Okay. Got it, I think. So Jake, do you think your tool could
394410	402030	work on ACF2 or TSS? Again, never been on that. I've only been on a couple of mainframe jobs.
402530	413730	But if it allows surrogate submission, then yeah. So from my kind of understanding of what
413730	422110	surrogates are, it's like a tree of delegated permissions, right? So you get this surrogate
422110	426050	permission for another user, and then you are effectively gaining all the rights of them,
426050	433330	right? So depending on what type of surrogate you give, so the main one is you'll have
433330	440170	user.star in class surrogate, and that means that you can submit a job as user.star,
440170	446750	but there's other type of ones you can have. But a lot of times, if you have surrogate and
446750	453010	one person, you can do all the stuff from that. Like, for example, there's one that I had where
453010	458670	you can, so surrogate, which allows you to write, to do su. But if you can do su, you can run any
458670	465950	TSO command. So it basically means you have full privileges on their thing. Got it. So is it
465950	469910	something that you have to like, generally you have to specifically invoke to get the other user's
469910	475850	permissions? Or do they all just like get wrapped up into... So that's one of the things that why
475850	483370	it required the tool was that you couldn't just... so if user1 had submit on user2, you couldn't
483370	493370	just run user2 stuff. You have to run a job as user2, and that will get returned sometime later.
493370	498430	So that's why the tool was required, is that you can't just run the... you don't have the privileges,
498430	505050	you can submit a job as that user. But yeah. Okay. I actually think that I like literally have
505050	508430	that in my head now. That's awesome. That was really well described.
513050	520140	What are your thoughts on JCL? It's a great language. It's... what am I...
521740	529340	Yeah, it's... it takes a while getting used to, because reading the IBM docs is... it's a skill in itself.
529340	533060	Like, I think I've actually started to... it's really... I don't know if it's something I should
533060	537500	be worried about, but I've actually started to be able to understand IBM documentation, and that's
538080	546540	worrying me. That does sound a little concerning. I'm like, wait, wait, I get it now? But yeah, so it's...
547520	552940	Yeah, so JCL is just a way to submit batch jobs, and yeah.
553680	559480	Is there any kind of like tooling that makes like interacting with that kind of like languages
559480	565680	easier? Or I know that like one of the current hot things is like building languages on top of languages.
567920	575820	So yeah, the writing... like whenever I wrote my programs or any type of thing that I use,
575820	580360	because it's just easier, it's the JCL. I don't really understand how... I don't really understand
580360	585880	how you pass like parameters to it. So I just put it all in like one little REC script, and then it
585880	590840	will just run itself. And then... so REC is like... it's just a scripting language. It's easy to use.
590840	602200	So I just... yeah, that's... yeah, that's right. Yeah, it's just... what is it? JCLs, they just...
602200	608620	there's lots of like programs that it can run that I have no clue what it does. But I know like...
608620	613780	it feels like I now know like what the most important ones do. So that's fine.
613780	622560	I mean, it's probably enough. Like if you know like 75% of most systems, you are very comfortable in that system.
625360	630600	So Jake, have you made any other tools that kind of help to assist with mainframe hacking?
630600	640000	Yeah, so I've got a couple which are varying in their usefulness. So I've got one which is...
640820	647620	so the database for all the security is held. It's just a database. So if you have access...
647620	652300	if you have write access to that, you have access to anything. So I created a quick tool which
652300	660040	if you do have write access to it, it will just insert... it will look for your user, find the special flag
660040	666680	and just turn it to one. So that's a tool which... it's very unlikely that you'll have access to that.
666680	670700	Like that is something that is audited. So it's like, make sure that no one has access to this file.
670700	676680	Because if they do, they have complete access to everything. What other tools? Oh, I made another...
678540	683680	so a SOCKS proxy in REX. So that allows you to... if there's any like...
685860	690640	so for example, if there's any like internal ports you want to hit, or if there's any like...
691440	696500	because everyone trusts the mainframe, so why wouldn't you accept all the firewall stuff from that?
696500	701000	So if there's anything you want to like hit from the mainframe, then there's a SOCKS proxy
701000	708040	which you can just run in REX and then just pass on to any port that you can see from there.
708040	714500	So REX is like... it's not just like a scripting language like bash, which just has like... consumes
714640	719180	a bunch of tools. Like it is like a language. Like it's like fully capable of doing like
720220	725220	hosting network sockets and stuff like that. Yeah, it can do... so REX, you can do anything
725220	729620	you want to do. And there's also a... I don't really understand what the functionality is,
729620	734300	but I know how to use it. So that's like... so if you run... if you write something called address...
734300	739020	so for example, so if you want to write a TSO command, you write address TSO,
739020	746480	and that means that any command you run in quotes runs as TSO. So the way I describe it is
746480	750180	that you can run a program as another program, but I don't even know if that's actually what's
750180	758920	happening. I just know that you can be like address DB2, which is an SQL database in IBM.
758920	767960	And that will then run a command as DB2. So it's a fairly useful language. You can just be like,
767960	773120	this program, I want to run this command. Yeah, it will do it.
773480	779620	Cool. Mainframe is asking, could you talk a little bit more about TK4 and the difference
779620	794760	between ZOS? So TK4 is... it's a beautiful thing. It's an open source mainframe from, well,
794760	798600	for a public domain. I don't know what the actual term, like specific term is, but it's a...
799160	804120	in 1980, they made a mainframe operating system, which is now in the public domain.
804760	811560	And so it made some tools, they made from there, they've created TK4. And TK4 just allows you to
811560	818660	just muck around with, I think I put it in my link in my presentation, but if you want,
818660	824840	just download that, like TK4. You can run it off anything. I found it off a Raspberry Pi,
824840	832060	so it's kind of fun. But yeah, if you want to run like, do like JCLs, you can install
834720	839820	Rex on there. You can install Kix, but also not actually... this was actually one of the things
839820	843300	in my presentation that like, I didn't know how to say, like, so there's something called
844760	849380	Kix with a C, and then something called Kix with a K. And I was trying to say the difference
849380	854340	between them. I was just like, so yeah, on my program, this has Kix, but this has Kix on here.
854340	862000	And I was like, wait a minute, I've just said the same thing twice. But yeah, so K-I-C-X is
862220	868040	a open source. If you want to muck around with Kix on there, which is one of the most, like,
868040	873860	used thing on a mainframe, it's kind of like a web server-ish type of thing. It's...
873860	877940	I don't know. There's no like equivalent to it, kind of. But yeah, if you...
880700	883300	Yeah, TK4 is really good. If you want to just muck around with...
884140	885260	Mainframe bits.
885680	889500	Yeah. And it's completely open source. So muck around with that.
890180	894300	Do you have... Do you know of any, like, good resources for, like, learning how to
894300	900600	use and operate a mainframe? Because it's like coming into it cold, which is like booting up a
900600	904600	Raspberry Pi image seems like...
906400	911960	Yeah, yeah. The best place... Well, the thing is, is that this is 1980s, my mainframe. So even the
911960	917680	IBM docs doesn't tell you what to do, how to do on this. So the kind of two places where it's
917680	924980	the most... So on... There's a Mattermost community called mainframe.community.
925740	930200	Super helpful. If you have any, like, stuff, asking questions on there, we'll get...
931120	938140	We'll actually get questions answers instead of just being like, ask your SME how to do this.
938140	943240	It's like, yeah. So mainframe.community, very good place for if you want to ask just, like, stuff.
943240	949920	But yeah, some other places you might find that your questions don't get answered, but that's good.
950780	960200	What other place? I think... So on my YouTube... There's this person called Moshix on YouTube.
960560	964320	Very, very helpful on, like, TK4, like, how to install these things, how to...
965460	968720	Yeah, how to do a lot of stuff on TK4.
969600	971080	Oh, excellent.
971600	977720	Now, was there anything for your research or even in your presentation that you didn't get to or
977720	984040	that you wanted to look further into that you maybe will look more into in the future? Or
984720	989180	you think it might be good if other people were to try to build upon what you've done?
993100	997240	So... So on the surrogate chains, I've basically just done the... There's the
997240	1004720	star.submit privileges and the ppx.serve.star privileges. But, like, there's other surrogate
1004720	1010760	classes. I don't really know how they work. But if they could all get... If, like... I don't know
1010760	1016320	how... And also how... If those surrogate classes, other classes, can get you access to everything,
1016320	1019940	then those should also be added to the program. Like, if that's... If there's, like, a...
1022120	1025860	Yeah, if there's another surrogate that I've missed, then yeah, that definitely should be
1025860	1031320	something that should be added. Is your... Have you, like, open sourced a tool? Is that publicly
1031320	1037760	available at this point? Yeah, on GitHub, I've put my... I think I've... Yeah, I've put my tool.
1037760	1041080	It's just... Have you actually made it live? Made it public?
1046930	1051410	I'll... I'll fling it onto the... Into the track chat.
1051890	1060210	Yeah. Oh, there's lots of chats. I'm very confused about where it is.
1060270	1064890	Yeah. I'm much of a Discord user, but... Good luck finding it. It is in the DefCon
1064890	1069850	talk tracks group. And you can either put it in track one... I found it. There you go.
1073190	1078650	That's... That's one of the things that... When you're on a client call and you can't work out
1078650	1083210	how the tech works, it's like... Sorry, I'm trying to work out how to get Skype working with my...
1083210	1087110	With my audio. Please give me 10 minutes to work this out, please.
1092780	1098040	I am running out of questions. Is there anything in particular that you want to, like, talk about
1098040	1105140	or advocate for or anything else you want to... Any other areas of interest in the infosec world?
1105140	1113160	Anything like that? Anything you want to share? I guess there's the thing about, like...
1113160	1119280	I think a lot of people are like, mainframes? Why mainframes? What's the point of them?
1119840	1128780	Yeah, it's... So, they do batch jobs incredibly, incredibly efficiently. Like,
1128780	1132600	people are like, oh, yeah, just go cloud. It's like... Yeah, you don't... When you're trying
1132600	1140140	to deal with, like, millions of, like, credit card transactions, it may not be the most
1140140	1147920	cost effective to do it on, like, an AWS instance. That might be pretty expensive.
1148240	1153280	And also, the other thing where all the code's already in, on a mainframe. So, like,
1154140	1160600	it's going to be pretty difficult to convert your COBOL code to, I don't know, whatever that you're
1160600	1164940	trying to convert it to. Yeah. Yeah. Any of the popular languages.
1167620	1171160	Haka is asking about bricking the mainframe.
1175240	1179660	I guess... With any of the things that you ever, like, play around with or do,
1179660	1184040	do you... Is that a concern? Is that something that you have to, like, keep in your mind?
1186260	1192720	The... There is a thing where, like, on client side that... So, when a web app,
1192720	1194840	when you're in a testing environment, you're like, okay, I'll just
1195340	1200440	keep throwing stuff at it. Let's see what happens. Let's see... Yeah, let's just keep
1200440	1206980	throwing random, like, scripts at it. On a mainframe, you're like, hello, like, person,
1206980	1211200	I'm testing this on. Can I throw this at this before I, like... I don't want to break your,
1211200	1217560	like, your massively expensive system. Let's just make sure this is okay first.
1217560	1224700	Like a major backbone in your organization. Can I just potentially screw it up right now?
1226500	1242280	Yeah. So, it's... There's also the fun thing is that, like, maybe on, like, a mainframe,
1242280	1248360	you might... The testing environment may be completely different to the actual, like,
1248360	1252740	production environment, which is great fun, where you're like, oh, look, I found something.
1252740	1259780	Is this a thing in your actual, like... No. Okay. Cool. That was a good, like, six hours
1259780	1269340	looking at that. Great. Thanks. Cool. So, it seems as though that what you're doing
1269340	1275280	is coming probably even more into demand. I'm seeing where people are looking for people that
1275280	1280800	can program in COBOL and maintain mainframes. Is this something that you think might be an
1280800	1285920	area that would be good for people to get into? And if so, if somebody with experience wanted to
1285920	1289940	make the jump over, what sorts of things could they look into? How could they even get started
1289940	1299660	in being able to support or test or work with mainframes? So, there is... So, I guess, like,
1299660	1306720	if you're in, like, a company, you could just shadow a job. That's probably, like... There's
1306720	1315020	also the... There is a ZOS 1.10 on Pirate Bay, which, of course, I would not be supporting.
1315020	1321820	You know, piracy is bad and very illegal. Never do that. But if you do have that, that might be useful.
1322520	1329440	But, yeah. So, who does still use mainframes today? Like, what industries or
1329440	1334520	major companies, if you can say any, still make use of mainframes?
1335080	1342760	So, basically, every bank that's big still uses mainframes there. Again, they're doing, like,
1342760	1347260	massive batch, like, jobs. And they already have all the infrastructure already. So, they're not
1347680	1351700	gonna... When they're, like, okay, who do we need to go... Do we need to, like... Do we want to move
1351700	1357160	everything to the cloud? Or do we want to continue on a mainframe? The answer to that question is
1357160	1364040	they're not going to change their entire system to get... To try and maybe... I don't even know if
1364040	1370680	it would save money, but maybe. I don't know. And then, I guess, a lot of governments still
1371200	1376560	use mainframes. Like, for example, I think there was a Freedom of Information request to the UK
1376560	1382620	government about what mainframes are still in use. And one of the things that really got me was...
1382620	1391580	So, this was to the people who do, like, the treasury, I think. And so, they were like,
1391580	1396500	okay, here are the four mainframes that are out of date that we use. And they're, like,
1396500	1403400	10 years old. And they also say, here are three other mainframes that are managed by Fujitsu that
1403400	1410560	we use. So, through some research, I'm pretty certain that these are, like, 20-year-old
1410560	1416980	mainframes that have, like, probably never, ever been looked at ever. They're just running, like...
1416980	1419820	And I looked at them, and I was like, okay, what are the ones that are running? It's like,
1419820	1425900	oh, these do all the customs in the UK. Huh. I bet they never want to ever change that shit ever.
1425940	1430640	They're literally just, like, we're never changing this 20-year-old mainframe that we have.
1431040	1435940	No one's ever looked at it. It's not even, like, it's not even an IBM mainframe. It's a
1437120	1442800	special UK mainframe that got bought out by Fujitsu that is now running the customs in
1442800	1449680	the UK. And I'm like, this has never been looked at. Like, even if a mainframe specialist looked
1449680	1454200	at it, they wouldn't be able to know anything. It's, like, it's written in this weird language
1454200	1459860	that I've never heard of. Maybe other people have heard of SCL? I don't know. Have you guys heard of
1459860	1463560	that? I think that I've come across that in another
1464100	1476440	DEF CON talk. Maybe. I get exposed to a lot of things. We did have another talk related to past
1476440	1483280	talks. Cahill says, I've enjoyed various ZOS talks at DEF CON over the last few years, but I never
1483280	1488080	hear about mainframe security otherwise. Are they a common attack target, or do they tend to go
1488080	1492260	overlooked because of the foreignness of the platform? What does the defense side look like
1492260	1497760	outside of the kind of audits you mentioned? I don't actually know, like, the access that...
1499020	1503220	so it feels like the only people who would actually be able to access this are people
1503220	1511960	who are fairly, like, sophisticated. You wouldn't have, like, just a random attacker going after a
1511960	1517400	mainframe, because it's normally, like, hidden in their internal network. So, like, it'd probably
1517400	1523880	be, like, a nation-state attacker, so, like, or, like, that type of, like, level. So I feel like
1523880	1529180	if it's an attack, they wouldn't be going after financial stuff, so you wouldn't really ever see
1529180	1535680	that it was happening, maybe? I don't know. I mean, like, there was the... oh, sorry, yeah.
1535680	1541180	Oh, sorry, sorry. I mean, so, like, this might have been in us chatting before the actual stream
1541180	1545500	start, but you did mention that you've, like, you found some mainframes that were just exposed
1545500	1554960	online just by dropping something into Shodan. So, like, maybe not just a deep internal threat.
1556240	1562960	Yeah, the majority of the ones I saw on Shodan were, like, there's actually a fun
1562960	1572180	site that mainframe sent me about all the internet. It's just a bot that you just...
1572180	1577420	people have sent mainframe IPs to it, and it just goes straight to the picture of the, like,
1577420	1584920	the initial screen of it. That, I think, is a fairly fun site, but yeah.
1586200	1594460	But yeah, so there's a couple of government ones, but a lot of them are just, like, emulated ones, but
1596920	1603060	yeah, I think it's... I think the thing I was going to say was that, like, if a nation-state
1603460	1609100	ever got a hold of something, it's unlikely they would ever, like, reveal themselves in that way,
1609100	1613200	that, like, that they had got access to that. Like, it's not, like, a criminal organization
1613200	1619740	where they'd be trying to, like, go after, like, those type of things. So, that's also a thing where
1620960	1625260	I don't know if there was in the news recently, the owner of Pirate Bay
1627020	1629780	hacked a mainframe. It was a while ago, but there's...
1631580	1635820	I must have missed that one. Yeah, it was...
1636940	1642020	But how secure are they from the inside? Would it be as simple as just being able to access
1642020	1646420	somebody's workstation from inside to be able to get to the mainframe?
1646420	1651200	Mainframe saying it's the Logica breach. Yeah, the Logica breach. And the fun thing about that
1651200	1655200	one as well is that they released... well, I don't know if they released on purpose,
1655200	1659500	but all of the, like, the court documents were released. It's on GitHub, by the way.
1659500	1665840	So, you can see the fun tools they used to, like, to access all the... to do all the stuff.
1668000	1672020	Mainframe says it's on WikiLeaks. So, anyone out there that's looking for more information...
1674460	1679500	Apparently, there's a lot more data out there. This sounds pretty fascinating.
1680560	1685180	Yeah, I was actually writing a tool, and I looked at Logica, and I was like,
1685180	1693440	wait a minute, they did this already. I got beat out by the hackers.
1693440	1697740	By a dump of random hacker activity. I love it.
1698440	1701040	So, you just had to one-up them by presenting at DEF CON.
1701700	1703840	Yeah. Yeah.
1704800	1709700	So, we are approaching the end of the time of our QA session. Is there anything else you want
1709700	1718100	to talk about while you still have the camera? I think I'm all topped out.
1720200	1724440	Fair enough. Well, thank you very much for doing this Q&A session. Thank you for
1724440	1728400	presenting to DEF CON, once again, for your first time. Really hope you come back. This
1728400	1733840	was great content. I need to get back to Vegas at least once.
1734000	1737400	You've got to experience in-person DEF CON as well.
1738580	1742800	All right. Well, thank you very much, and we'll talk to you later.