From Zero to Hero With z/OS

The talk opens by arguing that mainframes still run much of banking, payments and government, and that security teams often overlook them. It then sets out the core z/OS concepts an assessor needs: RACF as the external security manager, its access levels and classes, datasets, job control, Unix System Services and the CICS transaction system.

The middle section covers the offensive side. The speaker walks through reconnaissance with Nmap and NSE scripts, account enumeration against TSO, and the risk of unprotected FTP, which can submit jobs straight to the internal reader. A live demo shows a 3270 terminal application being manipulated by editing hidden fields so that a purchase the user was not allowed to make goes through. A second scenario follows a read-only audit account that searches job libraries for stored credentials, then uses a higher-privileged account to download the RACF database backup and crack its password hashes offline. Weak settings such as short usernames, short passwords and disabled case sensitivity make this easier.

The closing part points to learning resources, including an emulator, a Python-based deliberately vulnerable mainframe simulator and a CICS test application. The main takeaway is that mainframe access controls deserve the same scrutiny as directory services, and that default settings, shared passwords between Windows and mainframe accounts and forgotten FTP configurations are good places to start.