Philip young current state of mainframe hacking - vanguard - 101016

VANGUARD SECURITY & COMPLIANCE 2016

Philip Young Zed Sec 390

Session #1

The Current State of Mainframe Hacking

SECURITY & COMPLIANCE CONFERENCE 2016


DISCLAIMER

I’m not here in the name of or on behalf of my employer. All opinions expressed here are my own.





Question

Who here has seen my previous talks?


The Un-hackable?


Word on the Street

• I’ve heard all kinds of reasons why mainframes are “Un-hackable”

• Let’s walk through some of them now

“It’s not on the internet”


“It’s not on the internet”

• 2013 Started “finding” mainframes on the internet

• Using tools called masscan, nmap and x3270

• Various techniques found: 458

Welp

“Well, the ESM is impenetrable”


the ESM is impenetrable!

• This is true! • Lot’sof(memoneyandtes(nginvestedin‘hackproofing’ACF2,RACF,TopSecret

• Other impenetrable Security Products • MicrosoBAc(veDirectory• SELinux


the ESM is impenetrable!

• Misses the point

• Organic growth over decades

• I only need 1 malformed entitlement out of 600,000+

“You can’t just download a mainframe file and read it!”


Reading EBCDIC

• EBCDIC is easy to read with python!

print ’"%s"' % d.decode('EBCDIC-CP-BE').encode('ascii')

• Multiple tools exist to read XMI files, find strings in large files and decode EBCDIC.

• Fixed length makes this even easier

“IBM doesn’t publish vulnerabilities”

http://seclists.org/fulldisclosure/2016/Oct/43


Vulnerabilities

• This doesn’t make it safer.

• Please sign up for the IBM Security Portal

• I can understand IBMs position

“There’s never been a successful hack”


Stole

• $6,000 • Entire ‘social security’ database • Witness protection DB • Federal Tax source code

http://bit.ly/zbreach

Current State


New Tools!

• Network Job Entry Testing • Nmap (VTAM, TSO, CICS) • Metasploit • CICSpwn


Network Job Entry

• Used all over the world

• Facilitates management of different LPARs

• Allows transferring files, JCL


Configuration

• Declare ‘nodes’ in SYS1.PARMLIB(JES2PARM)

• Start NJE • Connect two systems together • Default port 175 • More Info: POC||GTFO #12


Attacking

• Identify port

• Identify OHOST/RHOST

• Emulate


Nmap Additions

• Service Identification • TN3270 Library:

• VTAMApplica(onEnumera(on• CICSTransac(onIDEnumera(on• TSOUserEnumera(on/Bruteforce• CICSUserEnumera(on(ACF2/TSS/RACF!)


Nmap TN3270 Library

• Nmap has a very powerful scripting engine • Uses LUA and custom libraries • Created a TN3270 emulator in LUA • Created it in to a library for Nmap • Opens up multiple possibilities!!


VTAM Enumeration

• VTAM allows a few commands: IBMTEST LOGON LOGOFF


CICS Transaction ID

• Using the same technique:


TSO User Enumeration

• TSO logon process allows for user enumeration

• Very slow by hand • Automate with Nmap!


TSO User Enumeration

• IBM has issued a fix!

• Turn PASSWORDPREPROMPT ON

• I’ve heard ACF2 and TopSecret have also resolved this!


CICS User Enumeration

• CICS logon process has same issue

• All three SAFs affected: • RACF• ACF2• TopSecret


Metasploit

• Used for penetration testing • Helps with centralized exploit management

• JCL libraries and first ‘exploit’ added to metasploit this year!

Source: http://securityweekly.com/2015/08/26/episode-431-interview-with-phil-young-and-chad-rikansrud/

Source:h*ps://github.com/rapid7/metasploit-framework/pull/6834


Chad Rikansrud

• Added support for FTP + JCL execution to Metasploit

• Added JCL library to Metasploit • Currently working on TN3270 library


CICSpwn

• New Tool!

• Python tool for attacking CICS

What Can I Do?


Hardest Challenges

• Compliance

• Secure Coding Guidelines

• Attack correlation


Compliance

• No clear industry best practice

• What does exist may be old and not inclusive

• Security Requirements written by non experts


Compliance

• Base yours on best practice •  Redbooks–all11kpages•  DoDDISASTIG

• Continuous Assessments •  Ensureaccidents/maliciousac(vi(esaredetected•  Appeasesauditors/audits

• Use available tools


Secure Coding

• Rare for widely used languages • PL/I• REXX• COBOL• HLASM

• Despite vulnerabilities existing!


Logging / Monitoring

• Export the logs • Real time monitoring a MUST! • Current monitoring process vs. Open Systems

• Use available tools!


Develop with me!

• New Tools and Techniques • New Best Practice • Better Audit Guides • Better Tutorials


Contact

• Twitter: @mainframed767 • Email: [email protected] • More Talks:

• VanguardSessionCST08• SHARESanJose


Thank you!

SECURITY & COMPLIANCE CONFERENCE 2016

Technology

Philip young current state of mainframe hacking - vanguard - 101016