5 ms·

A lot of financial systems are running COBOL on mainframes (which can look very pretty, check out the z13: https://www.google.com/search?q=z13&tbm=isch https://

A lot of financial systems are running COBOL on mainframes (which can look very pretty, check out the z13: https://www.google.com/search?q=z13&tbm=isch https://www.google.com/search?q=z13&tbm=isch ) There was a talk last year at DefCon that went over mainframe vulnerabilities, and it was like a playground. The biggest barrier to entry is getting a mainframe to experiment with.

padiyar83 10y ago
This reminds me of an article on wired[1] where someone hacked into hosts that were hooked into legacy X.25 networks. And just like mainframes and COBOL, there are not very many engineers who understand X.25 networks today, and hence had a very relaxed security posture. [1] https://www.wired.com/2016/05/maksym-igor-popov-fbi/ https://www.wired.com/2016/05/maksym-igor-popov-fbi/
- voltagex_ 10y ago
  Thank you for that article. It's fantastic - I'm assuming you also read KrebsOnSecurity? There are similar kinds of stories there.
jacobwcarlson 10y ago
> The biggest barrier to entry is getting a mainframe to experiment with. Is there a barrier to emulating these systems? It's probably difficult (illegal?) to emulate the various Tandem operating systems on virtual hardware, but I'm sure there's a way. I'd be shocked if there wasn't a turnkey AS/400 VM available.
- rollthehard6 10y ago
  It's trivial to emulate old versions of z/OS, have a look at Hercules - http://www.hercules-390.org/ http://www.hercules-390.org/ Not sure about OS/400 (IBM i) emulation, but you can get accounts to play with it seems - http://stackoverflow.com/questions/3487895/as400-emulator-or-virtual-machine http://stackoverflow.com/questions/3487895/as400-emulator-or...
partycoder 10y ago
Well that's another motivation for them to move to a blockchain based thing.
- ktRolster 10y ago
  Won't help if the software has bugs.
atemerev 10y ago
Once you are there, it is usually an open playground. These systems, however, are usually not on open networks and only pre-whitelisted connections are allowed.

padiyar83 10y ago

This reminds me of an article on wired[1] where someone hacked into hosts that were hooked into legacy X.25 networks. And just like mainframes and COBOL, there are not very many engineers who understand X.25 networks today, and hence had a very relaxed security posture. [1] https://www.wired.com/2016/05/maksym-igor-popov-fbi/ https://www.wired.com/2016/05/maksym-igor-popov-fbi/

voltagex_ 10y ago
Thank you for that article. It's fantastic - I'm assuming you also read KrebsOnSecurity? There are similar kinds of stories there.

jacobwcarlson 10y ago

> The biggest barrier to entry is getting a mainframe to experiment with. Is there a barrier to emulating these systems? It's probably difficult (illegal?) to emulate the various Tandem operating systems on virtual hardware, but I'm sure there's a way. I'd be shocked if there wasn't a turnkey AS/400 VM available.

rollthehard6 10y ago
It's trivial to emulate old versions of z/OS, have a look at Hercules - http://www.hercules-390.org/ http://www.hercules-390.org/ Not sure about OS/400 (IBM i) emulation, but you can get accounts to play with it seems - http://stackoverflow.com/questions/3487895/as400-emulator-or-virtual-machine http://stackoverflow.com/questions/3487895/as400-emulator-or...

partycoder 10y ago

Well that's another motivation for them to move to a blockchain based thing.

ktRolster 10y ago
Won't help if the software has bugs.

atemerev 10y ago

Once you are there, it is usually an open playground. These systems, however, are usually not on open networks and only pre-whitelisted connections are allowed.