5 ms·

Mainframes connected to the Internet

118 points by danners 11y ago

mattzito 11y ago
Random mainframe anecdote: I remember a client in the early 2000s who had a non-IBM mainframe that when originally implemented and designed predated the wide availability of Ethernet and TCP/IP. Everyone knew it was a piece of junk by the time I got involved, but their whole manufacturing system ran on it. In order to bring it up to some semblance of modernity and allow it to print to their shop printers, which were IP-driven, they had to get a third-party to procure and install (or build?) an ethernet interface for the machine, and fired up the TCP/IP stack. It kept crashing when they put it on the network, until they finally figured out that the issue was that the TCP/IP stack didn't understand multicast packets, and so whenever a stray multicast packet hit the interface, the whole thing threw up its hands and gave up. The solution was to keep the mainframe on a private network segment behind a firewall, not for security's sake, but because it was the only way to insure no multicast packets would hit it and halt production in three different factories
- krylon 11y ago
  Wow. I managed to crash the TCP/IP stack on z/OS during my training with a runaway Perl script that inadvertently had turned into a fork bomb. Luckily, it was just a testing/development system, and SNA kept working, so the only person to notice was the monitoring guy. And that system was IPL'ed on a regular basis (with the next one scheduled one or two days from that incident), so it was no biggie. I was really freaking out, though, until the others assured me that it was not a problem - "This is exactly why we don't let trainees on the production systems", as my supervisor put it. Since that day, I only use fork() very, very cautiously. :)
danners 11y ago
Interesting article / post about how to scan for mainframes: https://isc.sans.edu/forums/diary/The+80s+called+They+Want+Their+Mainframe+Back/14869/ https://isc.sans.edu/forums/diary/The+80s+called+They+Want+T...
aus_ 11y ago
For the security researchers out there, mainframes are really under-researched. There just aren't many people that have the expertise in the platform required for security research. And most of the people who do have expertise in the platform are often oblivious to technologies outside of the mainframe. (If you've ever dealt with mainframe people, you might know what I am talking about.) It's unfortunate, but too often true. Our best mainframe guy is brilliant. I've never met anyone more technically skilled in his platform. But ask him a basic Windows or a Linux question? Forget it. With today's complex stack of multiple platforms in most enterprises, a good security researcher, IMHO, should be fluent with both worlds. Mainframes are where some of our most critical data is stored. When you pull up your account balance through your bank's website, there's a good chance that value was read off a mainframe. Mainframers are old-school. They don't believe in public disclosure or open security models or public audits. If you go through the DEFCON and BlackHat archives, there's not much mainframe research out there. There's just a small community of mainframers on the Internet, but it's a significant part of the world's infrastructure. The mainframe world is a crazy alternate reality. (I know, because it's my day job.) Phillip Young, the guy who owns this Tumblr project, has made some waves in this community. His talks are a great place to start. Here's a few resources to get you started: [0]: http://mainframed767.tumblr.com/ http://mainframed767.tumblr.com/ [1]: http://bigendiansmalls.tumblr.com/ http://bigendiansmalls.tumblr.com/ [2]: https://media.blackhat.com/us-13/US-13-Young-Mainframes-The-Past-Will-Come-Back-to-Haunt-You-Slides.pdf https://media.blackhat.com/us-13/US-13-Young-Mainframes-The-... [3]: http://www.slideshare.net/bigendiansmalls/security-necromancy-publish http://www.slideshare.net/bigendiansmalls/security-necromanc... [4]: https://defcon.org/images/defcon-22/dc-22-presentations/Young/DEFCON-22-Philip-Young-From-root-to-SPECIAL-Hacking-IBM-Mainframes-Updated.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Youn... [5]: https://www.youtube.com/watch?v=Xfl4spvM5DI https://www.youtube.com/watch?v=Xfl4spvM5DI [6]: https://www.youtube.com/watch?v=5Ra4Ehmifh4 https://www.youtube.com/watch?v=5Ra4Ehmifh4 Also, IBM.com has a wealth of documentation. (They have terrible SEO though.) Checkout the z/OS RedBooks and manauls there.
- res0nat0r 11y ago
  Are there any places online to play with things like this? I used to admin Solaris machines back in the day and always wanted to learn more about mainframes. I'm not sure if there are any spots where you can get a free sandbox account on these types of things or not...
hellbanner 11y ago
How do I connect to one of these on linux or OSX?
- sp332 11y ago
  $ telnet 212.221.26.7 23
  - hellbanner 11y ago
    thanks I was trying nc
- emersonrsantos 11y ago
  You'll need a TN3270 client in most of the cases. There is x3270.bgp.nu which is open-source and runs on all desktop platforms.
ExpiredLink 11y ago
BTW, if someone wants to professionally connect Mainframes and Internet: http://www.softwareag.com/corporate/products/adabas_natural/appl_mod/products/applinx/overview/default.asp http://www.softwareag.com/corporate/products/adabas_natural/...
yarrel 11y ago
No Gibsons?
- deleted 11y ago
  [deleted]
- knieveltech 11y ago
  I see what you did there.
joeshaw 11y ago
On a related note, there are an alarmingly large number of hosts listening on port 23 (unencrypted telnet) on the internet: https://www.shodan.io/search?query=port%3A23 https://www.shodan.io/search?query=port%3A23 Most of them seem to be interfaces to network switches.

118 points by danners 11y ago

Random mainframe anecdote: I remember a client in the early 2000s who had a non-IBM mainframe that when originally implemented and designed predated the wide availability of Ethernet and TCP/IP. Everyone knew it was a piece of junk by the time I got involved, but their whole manufacturing system ran on it. In order to bring it up to some semblance of modernity and allow it to print to their shop printers, which were IP-driven, they had to get a third-party to procure and install (or build?) an ethernet interface for the machine, and fired up the TCP/IP stack. It kept crashing when they put it on the network, until they finally figured out that the issue was that the TCP/IP stack didn't understand multicast packets, and so whenever a stray multicast packet hit the interface, the whole thing threw up its hands and gave up. The solution was to keep the mainframe on a private network segment behind a firewall, not for security's sake, but because it was the only way to insure no multicast packets would hit it and halt production in three different factories

krylon 11y ago
Wow. I managed to crash the TCP/IP stack on z/OS during my training with a runaway Perl script that inadvertently had turned into a fork bomb. Luckily, it was just a testing/development system, and SNA kept working, so the only person to notice was the monitoring guy. And that system was IPL'ed on a regular basis (with the next one scheduled one or two days from that incident), so it was no biggie. I was really freaking out, though, until the others assured me that it was not a problem - "This is exactly why we don't let trainees on the production systems", as my supervisor put it. Since that day, I only use fork() very, very cautiously. :)

danners 11y ago

Interesting article / post about how to scan for mainframes: https://isc.sans.edu/forums/diary/The+80s+called+They+Want+Their+Mainframe+Back/14869/ https://isc.sans.edu/forums/diary/The+80s+called+They+Want+T...

aus_ 11y ago

For the security researchers out there, mainframes are really under-researched. There just aren't many people that have the expertise in the platform required for security research. And most of the people who do have expertise in the platform are often oblivious to technologies outside of the mainframe. (If you've ever dealt with mainframe people, you might know what I am talking about.) It's unfortunate, but too often true. Our best mainframe guy is brilliant. I've never met anyone more technically skilled in his platform. But ask him a basic Windows or a Linux question? Forget it. With today's complex stack of multiple platforms in most enterprises, a good security researcher, IMHO, should be fluent with both worlds. Mainframes are where some of our most critical data is stored. When you pull up your account balance through your bank's website, there's a good chance that value was read off a mainframe. Mainframers are old-school. They don't believe in public disclosure or open security models or public audits. If you go through the DEFCON and BlackHat archives, there's not much mainframe research out there. There's just a small community of mainframers on the Internet, but it's a significant part of the world's infrastructure. The mainframe world is a crazy alternate reality. (I know, because it's my day job.) Phillip Young, the guy who owns this Tumblr project, has made some waves in this community. His talks are a great place to start. Here's a few resources to get you started: [0]: http://mainframed767.tumblr.com/ http://mainframed767.tumblr.com/ [1]: http://bigendiansmalls.tumblr.com/ http://bigendiansmalls.tumblr.com/ [2]: https://media.blackhat.com/us-13/US-13-Young-Mainframes-The-Past-Will-Come-Back-to-Haunt-You-Slides.pdf https://media.blackhat.com/us-13/US-13-Young-Mainframes-The-... [3]: http://www.slideshare.net/bigendiansmalls/security-necromancy-publish http://www.slideshare.net/bigendiansmalls/security-necromanc... [4]: https://defcon.org/images/defcon-22/dc-22-presentations/Young/DEFCON-22-Philip-Young-From-root-to-SPECIAL-Hacking-IBM-Mainframes-Updated.pdf https://defcon.org/images/defcon-22/dc-22-presentations/Youn... [5]: https://www.youtube.com/watch?v=Xfl4spvM5DI https://www.youtube.com/watch?v=Xfl4spvM5DI [6]: https://www.youtube.com/watch?v=5Ra4Ehmifh4 https://www.youtube.com/watch?v=5Ra4Ehmifh4 Also, IBM.com has a wealth of documentation. (They have terrible SEO though.) Checkout the z/OS RedBooks and manauls there.

res0nat0r 11y ago
Are there any places online to play with things like this? I used to admin Solaris machines back in the day and always wanted to learn more about mainframes. I'm not sure if there are any spots where you can get a free sandbox account on these types of things or not...

hellbanner 11y ago

How do I connect to one of these on linux or OSX?

sp332 11y ago
$ telnet 212.221.26.7 23
- hellbanner 11y ago
  thanks I was trying nc
emersonrsantos 11y ago
You'll need a TN3270 client in most of the cases. There is x3270.bgp.nu which is open-source and runs on all desktop platforms.

ExpiredLink 11y ago

BTW, if someone wants to professionally connect Mainframes and Internet: http://www.softwareag.com/corporate/products/adabas_natural/appl_mod/products/applinx/overview/default.asp http://www.softwareag.com/corporate/products/adabas_natural/...

yarrel 11y ago

No Gibsons?

deleted 11y ago
[deleted]
knieveltech 11y ago
I see what you did there.

joeshaw 11y ago

On a related note, there are an alarmingly large number of hosts listening on port 23 (unencrypted telnet) on the internet: https://www.shodan.io/search?query=port%3A23 https://www.shodan.io/search?query=port%3A23 Most of them seem to be interfaces to network switches.