Mainframe Hacking for CICS and Giggles

The speakers argue that mainframe applications, particularly those built on CICS, get far less security testing than they deserve. Most mainframe talks concentrate on the operating system, so this one focuses on the application layer. They stress that these machines still underpin banking, insurance and government, yet many of the programs were written decades ago without security in mind. Getting started is hard: licences are costly, tooling is scarce and the documentation is old.

The core of the research is the 3270 data stream carried over TN3270. Because the terminal only sends input back to the host when a function key is pressed, a proxy can intercept traffic and flip the field attribute bits that control protection, numeric limits and visibility. Using that, the team made a protected price field editable, exposed a hidden purchase option, and reached a hidden screen by cycling through attention keys. They also brute-forced a four-digit supervisor code. All of this ran against a deliberately vulnerable demo application.

The team reports having seen these issues across roughly 50 real CICS applications, most of them reachable only internally, so the threat is closer to an insider. Mitigations include IBM's 3270 IDS, which needs tuning because it flags anomalies rather than malicious traffic, enforcing access control at the system level, and not hiding sensitive data in hidden fields. Practitioners can start learning with a Docker-packaged vulnerable CICS application.