WEBVTT 00:14.800 --> 00:17.280 And we are live. 00:17.940 --> 00:19.380 All right. 00:19.380 --> 00:28.200 We are here in another QA session with Jake LaBelle, talking about ZOS and surrogate chains. 00:29.060 --> 00:34.580 Jake, would you like to tell us a little bit about yourself and how you got into mainframe hacking? 00:35.520 --> 00:37.880 Hi, I'm Jake. 00:39.900 --> 00:46.520 So I guess how I got into it, my company does some jobs in it. 00:47.180 --> 00:51.420 I was looking at some of the reports they wrote and I went, that looks pretty cool. 00:51.420 --> 00:56.580 Looked at some pictures of mainframes and was like, yep, that looks like my type of thing. 00:56.580 --> 00:59.100 And yeah, just jumped right into it. 00:59.840 --> 01:03.860 Yeah, it's, I don't know, I think it looks cool. 01:03.860 --> 01:05.280 And so I just went for it. 01:05.280 --> 01:06.160 That's awesome. 01:06.360 --> 01:09.940 And I believe this is your first time presenting at DEF CON, correct? 01:10.260 --> 01:11.400 Yep, first time. 01:11.600 --> 01:22.420 So we have a tradition here at DEF CON, whenever you do your first talk, we welcome you onto the big stage with a drink. 01:23.460 --> 01:31.400 This is for contributing content back to the community and answer, taking the time to answer questions. 01:31.660 --> 01:33.820 So cheers to you, Jake. 01:33.820 --> 01:35.220 Welcome to DEF CON. 01:35.220 --> 01:35.740 Cheers . 01:35.740 --> 01:41.760 I may be a little jealous with filling up my drink though, so... 01:46.390 --> 01:47.430 All right. 01:48.670 --> 01:49.870 Cheers. 01:49.870 --> 01:50.490 Yeah. 01:51.670 --> 01:56.690 So we've already got a few questions that have been going through the chat. 01:56.810 --> 02:01.090 You kind of already mentioned like what got you into hacking mainframes. 02:01.350 --> 02:03.690 So I'm going to go on to the next one. 02:04.190 --> 02:11.850 Most high security systems, security plans will have periodic audits of rights to make sure the former super user accounts cannot be taken advantage of. 02:11.870 --> 02:17.750 Your talk sort of goes into how these permissions get chained between users and how they're just sort of left alone. 02:19.870 --> 02:25.150 Do you encounter any of these issues in audits where you're like, you have to remove these accounts? 02:25.150 --> 02:28.930 Or is it pretty much a no-go on touching things? 02:29.190 --> 02:39.050 I guess you'll have like with an audit, you'll have like, for example, okay, well, we don't want to make some users access this special user, which is basically root. 02:39.250 --> 02:42.950 But what about that user which accesses that user? 02:42.950 --> 02:45.690 What about that user which has access to that user? 02:45.750 --> 02:46.930 That's not really... 02:47.750 --> 02:48.810 possible to audit. 02:48.810 --> 02:56.750 You don't really have the ability to... you don't really have the ability when you're... well, you probably could, but they probably should, but they don't. 02:58.590 --> 03:06.850 And this... can you use this technique that you had to like... at one point you show like this massive graph viz graph of nodes. 03:07.250 --> 03:11.690 It looks like you were able to fully enumerate all those chains. 03:11.830 --> 03:15.030 Could you extend that into some kind of like security auditing? 03:16.490 --> 03:17.590 Yeah, 100%. 03:17.590 --> 03:23.630 So someone else who worked at the company, he made like a tool which... 03:24.630 --> 03:33.230 so this one is more of like a... not an exploitation tool, but like one that you would use if you didn't have full access. 03:33.230 --> 03:42.190 But if you had full access, what you could do is you're allowed to... you can do what's called unloading the RACF databases, which is all the security. 03:42.190 --> 03:46.570 So you can just take that and then offline you can use that to create all the tools. 03:46.570 --> 03:53.270 But this one's more for... because if you didn't have access, so from your user, what can you access? 03:53.270 --> 04:03.590 But from offline, someone else at the company was making a tool which takes the RACF database, puts it into any SQL database, and then you can query it however you like. 04:03.770 --> 04:05.470 Well, that sounds handy. 04:08.310 --> 04:11.410 Someone else is asking, ZOS is tied to IBM. 04:11.410 --> 04:13.690 Do you think this could be applied to IBM I? 04:14.810 --> 04:18.050 I've never been on a IBM I. 04:18.050 --> 04:25.410 I need to be on an IBM I system just to see what it's like, but I've never actually been on it, so I have no clue what the security is on there. 04:26.050 --> 04:26.790 Fair enough. 04:27.870 --> 04:33.530 So I've got to say that my knowledge of mainframes is fairly weak. 04:34.110 --> 04:42.410 When you were at the beginning of your talk, you mentioned a couple... you mentioned partition datasets versus normal ones as if they were significantly different. 04:42.410 --> 04:45.410 Could you explain what the differences are in those? 04:46.490 --> 04:55.310 Yeah, so there's no such thing as folders in ZOS, so I don't know why, but they like to have a flat file system. 04:55.310 --> 05:10.830 So instead of having that, you have datasets, and then there's just... datasets can have multiple members in them, so it's kind of like... it acts like a folder, but they're all part of one single file. 05:11.010 --> 05:13.250 So it's... I don't know. 05:13.250 --> 05:16.130 It's how they do it. 05:16.130 --> 05:22.110 So we think of the partition dataset as kind of like a file inside of a folder, and the dataset's the folder. 05:23.690 --> 05:24.230 Yeah. 05:24.230 --> 05:24.650 Yeah. 05:24.650 --> 05:25.430 Close enough? 05:25.430 --> 05:26.010 Yeah. 05:28.010 --> 05:29.630 Okay, fair enough. 05:30.190 --> 05:35.590 When I was going through it, the first thing was like, okay, how do these correlate to Unix things? 05:35.590 --> 05:38.710 And then it was like, wait a minute, nothing correlates. 05:38.710 --> 05:39.870 So what am I doing? 05:40.030 --> 05:42.710 That's kind of where I was going to go with. 05:42.710 --> 05:50.130 But you did mention the OMVS subsystem, I believe it was, that is a Unix-like environment. 05:50.410 --> 05:57.030 How comfortable would someone that is Linux-centric feel inside this OMVS environment? 05:57.370 --> 05:59.270 It's basically exactly the same. 05:59.270 --> 06:04.610 The only thing is that once you're in that system, you can run anything on the mainframe as well. 06:04.610 --> 06:14.190 So you can just say, you can run a TSO, which is the normal mainframe part, and just go TSO, whatever script you were going to run in the mainframe thing. 06:14.190 --> 06:26.570 So it's exactly the same as any sort of Linux system, like all the privileges are the same, just you can also, if you have it, you also have access to that user's mainframe stuff. 06:27.070 --> 06:27.490 Okay. 06:27.630 --> 06:29.490 Got it, I think. 06:31.550 --> 06:37.130 So Jake, do you think your tool could work on ACF2 or TSS? 06:38.710 --> 06:40.270 Again, never been on that. 06:40.270 --> 06:42.030 I've only been on a couple of mainframe jobs. 06:42.530 --> 06:49.410 But if it allows surrogate submission, then yeah. 06:50.350 --> 06:59.150 So from my kind of understanding of what surrogates are, it's like a tree of delegated permissions, right? 06:59.150 --> 07:06.770 So you get this surrogate permission for another user, and then you are effectively gaining all the rights of them, right? 07:07.350 --> 07:23.250 So depending on what type of surrogate you give, so the main one is you'll have user.star in class surrogate, and that means that you can submit a job as user.star, but there's other type of ones you can have. 07:23.250 --> 07:29.310 But a lot of times, if you have surrogate and one person, you can do all the stuff from that. 07:29.410 --> 07:36.610 Like, for example, there's one that I had where you can, so surrogate, which allows you to write, to do su. 07:36.610 --> 07:39.810 But if you can do su, you can run any TSO command. 07:39.810 --> 07:44.970 So it basically means you have full privileges on their thing. 07:45.190 --> 07:45.350 Got it. 07:45.350 --> 07:50.670 So is it something that you have to like, generally you have to specifically invoke to get the other user's permissions? 07:50.670 --> 08:07.870 Or do they all just like get wrapped up into... So that's one of the things that why it required the tool was that you couldn't just... so if user1 had submit on user2, you couldn't just run user2 stuff. 08:07.870 --> 08:13.370 You have to run a job as user2, and that will get returned sometime later. 08:13.370 --> 08:20.590 So that's why the tool was required, is that you can't just run the... you don't have the privileges, you can submit a job as that user. 08:20.690 --> 08:21.430 But yeah. 08:21.510 --> 08:21.790 Okay. 08:21.790 --> 08:25.750 I actually think that I like literally have that in my head now. 08:25.750 --> 08:26.810 That's awesome. 08:26.810 --> 08:28.430 That was really well described. 08:33.050 --> 08:35.850 What are your thoughts on JCL? 08:36.710 --> 08:38.610 It's a great language. 08:38.650 --> 08:40.140 It's... what am I... 08:41.740 --> 08:49.340 Yeah, it's... it takes a while getting used to, because reading the IBM docs is... it's a skill in itself. 08:49.340 --> 08:59.080 Like, I think I've actually started to... it's really... I don't know if it's something I should be worried about, but I've actually started to be able to understand IBM documentation, and that's worrying me. 08:59.180 --> 09:01.100 That does sound a little concerning. 09:01.240 --> 09:04.920 I'm like, wait, wait, I get it now? 09:04.920 --> 09:06.540 But yeah, so it's... 09:07.520 --> 09:12.940 Yeah, so JCL is just a way to submit batch jobs, and yeah. 09:13.680 --> 09:20.280 Is there any kind of like tooling that makes like interacting with that kind of like languages easier? 09:20.280 --> 09:25.680 Or I know that like one of the current hot things is like building languages on top of languages. 09:27.920 --> 09:37.820 So yeah, the writing... like whenever I wrote my programs or any type of thing that I use, because it's just easier, it's the JCL. 09:37.820 --> 09:42.400 I don't really understand how... I don't really understand how you pass like parameters to it. 09:42.400 --> 09:46.920 So I just put it all in like one little REC script, and then it will just run itself. 09:46.920 --> 09:49.720 And then... so REC is like... it's just a scripting language. 09:49.720 --> 09:50.840 It's easy to use. 09:50.840 --> 09:57.160 So I just... yeah, that's... yeah, that's right. 09:57.160 --> 10:00.880 Yeah, it's just... what is it? 10:01.100 --> 10:02.200 JCLs, they just... 10:02.200 --> 10:06.500 there's lots of like programs that it can run that I have no clue what it does. 10:06.560 --> 10:08.620 But I know like... 10:08.620 --> 10:12.080 it feels like I now know like what the most important ones do. 10:12.080 --> 10:13.780 So that's fine. 10:13.780 --> 10:16.440 I mean, it's probably enough. 10:16.440 --> 10:22.560 Like if you know like 75% of most systems, you are very comfortable in that system. 10:25.360 --> 10:30.600 So Jake, have you made any other tools that kind of help to assist with mainframe hacking? 10:30.600 --> 10:37.080 Yeah, so I've got a couple which are varying in their usefulness. 10:37.080 --> 10:40.000 So I've got one which is... 10:40.820 --> 10:43.860 so the database for all the security is held. 10:43.860 --> 10:45.840 It's just a database. 10:45.840 --> 10:47.620 So if you have access... 10:47.620 --> 10:50.800 if you have write access to that, you have access to anything. 10:50.800 --> 11:01.520 So I created a quick tool which if you do have write access to it, it will just insert... it will look for your user, find the special flag and just turn it to one. 11:01.840 --> 11:06.680 So that's a tool which... it's very unlikely that you'll have access to that. 11:06.680 --> 11:08.080 Like that is something that is audited. 11:08.080 --> 11:10.700 So it's like, make sure that no one has access to this file. 11:10.700 --> 11:13.640 Because if they do, they have complete access to everything. 11:15.240 --> 11:16.100 What other tools? 11:16.100 --> 11:16.680 Oh, I made another... 11:18.540 --> 11:21.320 so a SOCKS proxy in REX. 11:21.460 --> 11:23.680 So that allows you to... if there's any like... 11:25.860 --> 11:30.640 so for example, if there's any like internal ports you want to hit, or if there's any like... 11:31.440 --> 11:36.500 because everyone trusts the mainframe, so why wouldn't you accept all the firewall stuff from that? 11:36.500 --> 11:48.040 So if there's anything you want to like hit from the mainframe, then there's a SOCKS proxy which you can just run in REX and then just pass on to any port that you can see from there. 11:48.040 --> 11:55.160 So REX is like... it's not just like a scripting language like bash, which just has like... consumes a bunch of tools. 11:55.160 --> 11:56.920 Like it is like a language. 11:56.920 --> 12:03.040 Like it's like fully capable of doing like hosting network sockets and stuff like that. 12:03.440 --> 12:06.580 Yeah, it can do... so REX, you can do anything you want to do. 12:06.580 --> 12:10.720 And there's also a... I don't really understand what the functionality is, but I know how to use it. 12:10.720 --> 12:14.300 So that's like... so if you run... if you write something called address... 12:14.300 --> 12:24.880 so for example, so if you want to write a TSO command, you write address TSO, and that means that any command you run in quotes runs as TSO. 12:25.100 --> 12:30.500 So the way I describe it is that you can run a program as another program, but I don't even know if that's actually what's happening. 12:30.500 --> 12:38.920 I just know that you can be like address DB2, which is an SQL database in IBM. 12:38.920 --> 12:43.340 And that will then run a command as DB2. 12:43.340 --> 12:46.620 So it's a fairly useful language. 12:46.620 --> 12:51.280 You can just be like, this program, I want to run this command. 12:51.500 --> 12:53.120 Yeah, it will do it. 12:53.480 --> 12:54.560 Cool. 12:54.660 --> 13:00.940 Mainframe is asking, could you talk a little bit more about TK4 and the difference between ZOS? 13:02.640 --> 13:08.800 So TK4 is... it's a beautiful thing. 13:08.800 --> 13:15.740 It's an open source mainframe from, well, for a public domain. 13:15.740 --> 13:18.600 I don't know what the actual term, like specific term is, but it's a... 13:19.160 --> 13:24.120 in 1980, they made a mainframe operating system, which is now in the public domain. 13:24.760 --> 13:29.440 And so it made some tools, they made from there, they've created TK4. 13:29.880 --> 13:41.500 And TK4 just allows you to just muck around with, I think I put it in my link in my presentation, but if you want, just download that, like TK4. 13:41.500 --> 13:43.220 You can run it off anything. 13:43.220 --> 13:46.300 I found it off a Raspberry Pi, so it's kind of fun. 13:46.620 --> 13:55.780 But yeah, if you want to run like, do like JCLs, you can install Rex on there. 13:55.800 --> 14:07.860 You can install Kix, but also not actually... this was actually one of the things in my presentation that like, I didn't know how to say, like, so there's something called Kix with a C, and then something called Kix with a K. 14:07.860 --> 14:09.860 And I was trying to say the difference between them. 14:09.860 --> 14:14.340 I was just like, so yeah, on my program, this has Kix, but this has Kix on here. 14:14.340 --> 14:17.620 And I was like, wait a minute, I've just said the same thing twice. 14:17.980 --> 14:23.400 But yeah, so K-I-C-X is a open source. 14:23.400 --> 14:32.760 If you want to muck around with Kix on there, which is one of the most, like, used thing on a mainframe, it's kind of like a web server-ish type of thing. 14:33.460 --> 14:33.860 It's... 14:33.860 --> 14:35.120 I don't know. 14:35.120 --> 14:37.200 There's no like equivalent to it, kind of. 14:37.200 --> 14:37.940 But yeah, if you... 14:40.700 --> 14:42.280 Yeah, TK4 is really good. 14:42.280 --> 14:43.300 If you want to just muck around with... 14:44.140 --> 14:45.260 Mainframe bits. 14:45.680 --> 14:46.040 Yeah. 14:46.040 --> 14:47.960 And it's completely open source. 14:47.960 --> 14:49.500 So muck around with that. 14:50.180 --> 14:56.220 Do you have... Do you know of any, like, good resources for, like, learning how to use and operate a mainframe? 14:56.540 --> 15:07.040 Because it's like coming into it cold, which is like booting up a Raspberry Pi image seems like... Yeah , yeah. 15:07.040 --> 15:11.320 The best place... Well, the thing is, is that this is 1980s, my mainframe. 15:11.320 --> 15:14.260 So even the IBM docs doesn't tell you what to do, how to do on this. 15:14.260 --> 15:24.980 So the kind of two places where it's the most... So on... There's a Mattermost community called mainframe.community. 15:25.740 --> 15:27.020 Super helpful. 15:27.020 --> 15:30.200 If you have any, like, stuff, asking questions on there, we'll get... 15:31.120 --> 15:38.140 We'll actually get questions answers instead of just being like, ask your SME how to do this. 15:38.140 --> 15:38.980 It's like, yeah. 15:38.980 --> 15:43.240 So mainframe.community, very good place for if you want to ask just, like, stuff. 15:43.240 --> 15:49.920 But yeah, some other places you might find that your questions don't get answered, but that's good. 15:50.780 --> 15:52.280 What other place? 15:53.460 --> 16:00.200 I think... So on my YouTube... There's this person called Moshix on YouTube. 16:00.560 --> 16:04.320 Very, very helpful on, like, TK4, like, how to install these things, how to... 16:05.460 --> 16:08.720 Yeah, how to do a lot of stuff on TK4. 16:09.600 --> 16:11.080 Oh, excellent. 16:11.600 --> 16:23.840 Now, was there anything for your research or even in your presentation that you didn't get to or that you wanted to look further into that you maybe will look more into in the future? 16:23.840 --> 16:29.180 Or you think it might be good if other people were to try to build upon what you've done? 16:33.100 --> 16:42.680 So... So on the surrogate chains, I've basically just done the... There's the star.submit privileges and the ppx.serve.star privileges. 16:42.680 --> 16:45.560 But, like, there's other surrogate classes. 16:45.620 --> 16:47.520 I don't really know how they work. 16:47.580 --> 16:58.100 But if they could all get... If, like... I don't know how... And also how... If those surrogate classes, other classes, can get you access to everything, then those should also be added to the program. 16:58.100 --> 16:59.940 Like, if that's... If there's, like, a... 17:02.120 --> 17:08.080 Yeah, if there's another surrogate that I've missed, then yeah, that definitely should be something that should be added. 17:08.100 --> 17:10.800 Is your... Have you, like, open sourced a tool? 17:10.800 --> 17:12.480 Is that publicly available at this point? 17:12.480 --> 17:17.760 Yeah, on GitHub, I've put my... I think I've... Yeah, I've put my tool. 17:17.760 --> 17:20.240 It's just... Have you actually made it live? 17:20.240 --> 17:21.080 Made it public? 17:26.930 --> 17:31.410 I'll... I'll fling it onto the... Into the track chat. 17:31.890 --> 17:32.630 Yeah. 17:36.530 --> 17:38.210 Oh, there's lots of chats. 17:38.210 --> 17:40.210 I'm very confused about where it is. 17:40.270 --> 17:40.850 Yeah. 17:40.850 --> 17:44.070 I'm much of a Discord user, but... Good luck finding it. 17:44.070 --> 17:46.370 It is in the DefCon talk tracks group. 17:46.410 --> 17:49.010 And you can either put it in track one... I found it. 17:49.010 --> 17:49.850 There you go. 17:53.190 --> 18:03.210 That's... That's one of the things that... When you're on a client call and you can't work out how the tech works, it's like... Sorry, I'm trying to work out how to get Skype working with my... 18:03.210 --> 18:04.310 With my audio. 18:04.310 --> 18:07.110 Please give me 10 minutes to work this out, please. 18:12.780 --> 18:15.020 I am running out of questions. 18:15.020 --> 18:25.140 Is there anything in particular that you want to, like, talk about or advocate for or anything else you want to... Any other areas of interest in the infosec world? 18:25.140 --> 18:25.900 Anything like that? 18:25.900 --> 18:27.020 Anything you want to share? 18:30.800 --> 18:33.160 I guess there's the thing about, like... 18:33.160 --> 18:36.140 I think a lot of people are like, mainframes? 18:36.680 --> 18:37.920 Why mainframes? 18:37.920 --> 18:39.280 What's the point of them? 18:39.840 --> 18:47.840 Yeah, it's... So, they do batch jobs incredibly, incredibly efficiently. 18:47.860 --> 18:50.340 Like, people are like, oh, yeah, just go cloud. 18:50.340 --> 19:05.960 It's like... Yeah, you don't... When you're trying to deal with, like, millions of, like, credit card transactions, it may not be the most cost effective to do it on, like, an AWS instance. 19:05.960 --> 19:07.920 That might be pretty expensive. 19:08.240 --> 19:12.600 And also, the other thing where all the code's already in, on a mainframe. 19:12.600 --> 19:21.860 So, like, it's going to be pretty difficult to convert your COBOL code to, I don't know, whatever that you're trying to convert it to. 19:21.860 --> 19:22.400 Yeah. 19:22.420 --> 19:22.420 Yeah. 19:22.620 --> 19:24.940 Any of the popular languages. 19:27.620 --> 19:31.160 Haka is asking about bricking the mainframe. 19:35.240 --> 19:41.180 I guess... With any of the things that you ever, like, play around with or do, do you... Is that a concern? 19:41.180 --> 19:44.040 Is that something that you have to, like, keep in your mind? 19:46.260 --> 19:56.680 The... There is a thing where, like, on client side that... So, when a web app, when you're in a testing environment, you're like, okay, I'll just keep throwing stuff at it. 19:56.680 --> 19:57.820 Let's see what happens. 19:57.820 --> 20:03.120 Let's see... Yeah, let's just keep throwing random, like, scripts at it. 20:03.120 --> 20:07.920 On a mainframe, you're like, hello, like, person, I'm testing this on. 20:07.920 --> 20:14.420 Can I throw this at this before I, like... I don't want to break your, like, your massively expensive system. 20:15.060 --> 20:17.560 Let's just make sure this is okay first. 20:17.560 --> 20:21.120 Like a major backbone in your organization. 20:21.140 --> 20:24.700 Can I just potentially screw it up right now? 20:26.500 --> 20:27.160 Yeah. 20:27.160 --> 20:52.740 So, it's... There's also the fun thing is that, like, maybe on, like, a mainframe, you might... The testing environment may be completely different to the actual, like, production environment, which is great fun, where you're like, oh, look, I found something. 20:52.740 --> 20:55.940 Is this a thing in your actual, like... No. 20:55.940 --> 20:56.400 Okay. 20:56.400 --> 20:56.860 Cool. 20:56.860 --> 21:00.480 That was a good, like, six hours looking at that. 21:00.480 --> 21:00.700 Great. 21:00.700 --> 21:01.600 Thanks. 21:01.660 --> 21:02.740 Cool. 21:05.100 --> 21:12.400 So, it seems as though that what you're doing is coming probably even more into demand. 21:12.400 --> 21:18.380 I'm seeing where people are looking for people that can program in COBOL and maintain mainframes. 21:18.380 --> 21:23.220 Is this something that you think might be an area that would be good for people to get into? 21:23.220 --> 21:28.740 And if so, if somebody with experience wanted to make the jump over, what sorts of things could they look into? 21:28.740 --> 21:34.280 How could they even get started in being able to support or test or work with mainframes? 21:35.060 --> 21:44.900 So, there is... So, I guess, like, if you're in, like, a company, you could just shadow a job. 21:44.940 --> 21:55.020 That's probably, like... There's also the... There is a ZOS 1.10 on Pirate Bay, which, of course, I would not be supporting. 21:55.020 --> 21:57.120 You know, piracy is bad and very illegal. 21:57.120 --> 21:58.700 Never do that. 21:58.840 --> 22:01.820 But if you do have that, that might be useful. 22:02.520 --> 22:03.120 But, yeah. 22:03.120 --> 22:08.000 So, who does still use mainframes today? 22:08.000 --> 22:14.520 Like, what industries or major companies, if you can say any, still make use of mainframes? 22:15.080 --> 22:21.060 So, basically, every bank that's big still uses mainframes there. 22:21.500 --> 22:24.700 Again, they're doing, like, massive batch, like, jobs. 22:24.940 --> 22:26.880 And they already have all the infrastructure already. 22:26.880 --> 22:32.540 So, they're not gonna... When they're, like, okay, who do we need to go... Do we need to, like... Do we want to move everything to the cloud? 22:32.540 --> 22:34.860 Or do we want to continue on a mainframe? 22:35.680 --> 22:45.780 The answer to that question is they're not going to change their entire system to get... To try and maybe... I don't even know if it would save money, but maybe. 22:45.780 --> 22:46.660 I don't know. 22:47.060 --> 22:52.220 And then, I guess, a lot of governments still use mainframes. 22:52.220 --> 23:00.120 Like, for example, I think there was a Freedom of Information request to the UK government about what mainframes are still in use. 23:00.120 --> 23:02.620 And one of the things that really got me was... 23:02.620 --> 23:10.140 So, this was to the people who do, like, the treasury, I think. 23:10.500 --> 23:15.320 And so, they were like, okay, here are the four mainframes that are out of date that we use. 23:15.320 --> 23:17.860 And they're, like, 10 years old. 23:18.060 --> 23:24.360 And they also say, here are three other mainframes that are managed by Fujitsu that we use. 23:25.220 --> 23:34.300 So, through some research, I'm pretty certain that these are, like, 20-year-old mainframes that have, like, probably never, ever been looked at ever. 23:34.420 --> 23:36.980 They're just running, like... 23:36.980 --> 23:39.200 And I looked at them, and I was like, okay, what are the ones that are running? 23:39.200 --> 23:41.980 It's like, oh, these do all the customs in the UK. 23:42.500 --> 23:43.180 Huh. 23:43.360 --> 23:45.900 I bet they never want to ever change that shit ever. 23:45.940 --> 23:50.640 They're literally just, like, we're never changing this 20-year-old mainframe that we have. 23:51.040 --> 23:52.180 No one's ever looked at it. 23:52.180 --> 23:55.520 It's not even, like, it's not even an IBM mainframe. 23:55.520 --> 24:03.260 It's a special UK mainframe that got bought out by Fujitsu that is now running the customs in the UK. 24:03.260 --> 24:06.040 And I'm like, this has never been looked at. 24:07.300 --> 24:11.480 Like, even if a mainframe specialist looked at it, they wouldn't be able to know anything. 24:11.480 --> 24:16.620 It's, like, it's written in this weird language that I've never heard of. 24:16.620 --> 24:18.720 Maybe other people have heard of SCL? 24:18.780 --> 24:19.260 I don't know. 24:19.260 --> 24:20.160 Have you guys heard of that? 24:20.160 --> 24:25.600 I think that I've come across that in another DEF CON talk. 24:26.040 --> 24:26.480 Maybe. 24:26.960 --> 24:29.240 I get exposed to a lot of things. 24:31.800 --> 24:37.340 We did have another talk related to past talks. 24:38.140 --> 24:45.460 Cahill says, I've enjoyed various ZOS talks at DEF CON over the last few years, but I never hear about mainframe security otherwise. 24:45.460 --> 24:50.700 Are they a common attack target, or do they tend to go overlooked because of the foreignness of the platform? 24:50.700 --> 24:54.240 What does the defense side look like outside of the kind of audits you mentioned? 24:55.480 --> 24:57.760 I don't actually know, like, the access that... 24:59.020 --> 25:08.000 so it feels like the only people who would actually be able to access this are people who are fairly, like, sophisticated. 25:08.000 --> 25:15.800 You wouldn't have, like, just a random attacker going after a mainframe , because it's normally, like, hidden in their internal network. 25:15.800 --> 25:22.120 So, like, it'd probably be, like, a nation-state attacker, so, like, or, like, that type of, like, level. 25:22.140 --> 25:30.740 So I feel like if it's an attack, they wouldn't be going after financial stuff, so you wouldn't really ever see that it was happening, maybe? 25:30.740 --> 25:31.620 I don't know. 25:31.700 --> 25:35.680 I mean, like, there was the... oh, sorry, yeah. 25:35.680 --> 25:36.500 Oh, sorry, sorry. 25:36.500 --> 25:49.660 I mean, so, like, this might have been in us chatting before the actual stream start, but you did mention that you've, like, you found some mainframes that were just exposed online just by dropping something into Shodan. 25:49.880 --> 25:54.960 So, like, maybe not just a deep internal threat. 25:56.240 --> 26:09.340 Yeah, the majority of the ones I saw on Shodan were, like, there's actually a fun site that mainframe sent me about all the internet. 26:09.340 --> 26:12.180 It's just a bot that you just... 26:12.180 --> 26:18.800 people have sent mainframe IPs to it, and it just goes straight to the picture of the, like, the initial screen of it. 26:18.800 --> 26:24.920 That, I think, is a fairly fun site, but yeah. 26:26.200 --> 26:46.780 But yeah, so there's a couple of government ones, but a lot of them are just, like, emulated ones, but yeah, I think it's... I think the thing I was going to say was that, like, if a nation-state ever got a hold of something, it's unlikely they would ever, 26:46.780 --> 26:51.880 like, reveal themselves in that way, that, like, that they had got access to that. 26:51.880 --> 26:57.900 Like, it's not, like, a criminal organization where they'd be trying to, like, go after, like, those type of things. 26:57.900 --> 27:08.200 So, that's also a thing where I don't know if there was in the news recently, the owner of Pirate Bay hacked a mainframe. 27:08.200 --> 27:09.780 It was a while ago, but there's... 27:11.580 --> 27:13.240 I must have missed that one. 27:13.520 --> 27:15.820 Yeah, it was... 27:16.940 --> 27:19.300 But how secure are they from the inside? 27:19.300 --> 27:26.420 Would it be as simple as just being able to access somebody's workstation from inside to be able to get to the mainframe? 27:26.420 --> 27:28.740 Mainframe saying it's the Logica breach. 27:29.260 --> 27:30.300 Yeah, the Logica breach. 27:30.300 --> 27:38.060 And the fun thing about that one as well is that they released... well, I don't know if they released on purpose, but all of the, like, the court documents were released. 27:38.060 --> 27:39.500 It's on GitHub, by the way. 27:39.500 --> 27:45.840 So, you can see the fun tools they used to, like, to access all the... to do all the stuff. 27:48.000 --> 27:49.980 Mainframe says it's on WikiLeaks. 27:49.980 --> 27:52.020 So, anyone out there that's looking for more information... 27:54.460 --> 27:56.780 Apparently, there's a lot more data out there. 27:57.680 --> 27:59.500 This sounds pretty fascinating. 28:00.560 --> 28:07.960 Yeah, I was actually writing a tool, and I looked at Logica, and I was like, wait a minute, they did this already. 28:08.260 --> 28:13.440 I got beat out by the hackers. 28:13.440 --> 28:16.820 By a dump of random hacker activity. 28:16.820 --> 28:17.740 I love it. 28:18.440 --> 28:21.040 So, you just had to one-up them by presenting at DEF CON. 28:21.700 --> 28:22.500 Yeah. 28:23.260 --> 28:23.840 Yeah. 28:24.800 --> 28:28.500 So, we are approaching the end of the time of our QA session. 28:28.500 --> 28:31.940 Is there anything else you want to talk about while you still have the camera? 28:35.160 --> 28:38.100 I think I'm all topped out. 28:40.200 --> 28:41.000 Fair enough. 28:41.000 --> 28:43.640 Well, thank you very much for doing this Q&A session. 28:43.640 --> 28:47.020 Thank you for presenting to DEF CON, once again, for your first time. 28:47.020 --> 28:48.280 Really hope you come back. 28:48.280 --> 28:49.780 This was great content. 28:50.320 --> 28:53.840 I need to get back to Vegas at least once. 28:54.000 --> 28:57.400 You've got to experience in-person DEF CON as well. 28:58.580 --> 28:59.320 All right. 28:59.320 --> 29:02.800 Well, thank you very much, and we'll talk to you later.