Gaps in Your Defense: Hacking the Mainframe

World®’16

GapsinYourDefense:HackingtheMainframePhilipYoung- Co-Founder- ZedSec 390

MFT175S

MAINFRAMEANDWORKLOADAUTOMATION

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation


Abstract

Themainframeisthemission-essentialbackboneoftheenterprise,housingover70percentofcorporatedata,touchingmorethanhalfofallapplications,andconnectingtotheinternetandInternetofThings(IoT)throughAPIs.However,intheenterprisesecuritydiscussion,themainframeisoftenpresumedtobeinherentlysecure.Thissessionwilldiveintothecurrentstateofmainframeofmainframehacking,whyhackersaretakingalargerinterestintheplatform,adiscussionofcomplianceversussecurityandnextstepsonhowyoucanoptimizethesecurityofyourmostmission-essentialbusinessasset.

PhilipYoungZedSec 390Co-Founder


Disclaimer

I’mnothereinthenameoforonbehalfofmyemployer.Allopinionsexpressedherearemyown.

PhilipYoungZedSec 390Co-Founder


CommonMyths

IT’SNOTONTHEINTERNET

IT’SIMPENETRABLE

HACKERSDON’TKNOWABOUTITHACKERSDON’TKNOWABOUTIT

BUTWE’REAUDITEDALLOFTHETIME


The‘IMP’

§ Startedin2013

§ Tools:– MassScan– Nmap– Python– X3270– LinuxVPS

§ Databaseof400+mainframes

https://mainframesproject.tumblr.com/

InternetMainframesProject


ItDoesn’tMatter


EnterprisesareFlat

§ Manylargeenterprisesexperiencedabreachin2015

§ Flatnetworks

§ Nofirewallbetween“Corporate”networkandmainframe


HackingtheUnhackable

§ Fromthenetwork

§ Noknowledgeofthesystem

§ Steps– Gatherinformation– Profilethesystem– Launchattacks

Toolsreleased/updatedin2015/2016


Nmap in2015/2016

•Anon?•SITE?•OSVersion?

• Information•VTAM?•CICS?•TSO?

•Version?•Nikto?•BURP?•Enumerate?• JavaObjects


TN3270Screen


VTAMEnumeration


TSOUserEnumeration


CICSTransactionEnumeration


Removed

Removed

Removed


CICSpwn


CICSpwn:TSOShell


FTPAuthorizedCodeExec


WhatCanIDo?

§ Complianceisliterallythestart

§ Justbecauseyou’recompliantdoesn’tmean:– Thecompliancerulesarewelldone– Representcurrentthreats– Matchcurrentbaselines

§ VulnerabilityScanning?


GapAssessment

§ Compareyourrequirementstoastandard

§ Howdoyoucompareandcontrast?

§ Who’sexpertiseareyourelyingon?


GoBeyondCompliance

§ zAssure?

§ IdentifyingDataAssets?

§ LoggingandMonitoring?– zSecure– IronStream– Vanguard

§ PenetrationTesting?


CICSpwnhttps://github.com/ayoul3/cicspwn

Nmap Scriptshttps://github.com/zedsec390/NMAP

Metasploithttps://github.com/rapid7/metasploit-framework

Contact&ReferencesTwitter:@mainframed767E-Mail:[email protected]


Stayconnectedatcommunities.ca.com

Thankyou.


MustSeeDemos

Real-TimeDataSecurity&Compliance

CADataContentDiscoveryMainframeTheatre

MainframeSecuritySmartBar

CATopSecretMainframeTheatre

Real-TimeDataSecurity&Compliance

CAComplianceEventManagerMainframeTheatre

MainframeSecuritySmartBar

CAACF2MainframeTheatre


MainframeandWorkloadAutomation

FormoreinformationonMainframeandWorkloadAutomation,pleasevisit:http://cainc.to/9GQ2JI

Gaps in Your Defense: Hacking the Mainframe

Technology

Transcript of Gaps in Your Defense: Hacking the Mainframe