Mainframe Hacking for CICS and Giggles

The talk starts from the point that mainframes still run banking, airline, government and insurance workloads, so their security matters even though they are often dismissed as legacy. The presenters explain why testing them is hard: few learning resources exist, the community is guarded toward outsiders, and commercial emulation and tooling are expensive or scarce. They walk through CICS as the online transaction layer, with regions and four-character transaction IDs, and show that 3270 traffic carried over TN3270 can be read in a packet analyzer.

The middle section focuses on the 3270 data stream. The researchers found that the start field orders and field attribute bits decide whether a field is protected, numeric-only or hidden, so changing those bits in transit changes what the application enforces. They built a proxy tool that sits between the terminal emulator and the mainframe, and demonstrated it against an intentionally vulnerable CICS application running in a free MVS 3.8 environment. The demo covered brute forcing a supervisor code, unlocking a protected price field, revealing a hidden approval field, cycling through attention keys to find hidden screens, and using the logging views to document each step.

The closing part offers defensive guidance: enforce authorization per transaction with a system such as RACF, never rely on hidden fields to protect data, and do not treat unused function keys as safe places for hidden functions. The presenters also assessed the mainframe intrusion detection options and found them limited. The takeaway is that mainframe applications deserve the same testing as web systems, and that open-source resources now make learning this area practical.