The attacker created zero day exploits against z/OS in the wild allowing escalation of privilege and proved difficult to dislodge even once discovered. Information available to the public supports this. Phil Young has done a good job of dissecting the hack.
Philip Young - Smashing the Mainframe for Fun and Prison Time https://youtu.be/SjtyifWTqmc And How Hackers Breached a Government (and a Bank) https://share.confex.com/share/124/webprogram/Handout/Session16982/How%20Hackers%20Breached%20a%20Government%20%28and%20a%20Bank%29.pdf z/OS on IBMz hardware is the most securable environment in the world but as public evidence supports it was compromised. It would seem fair to say the mainframe was hacked. Best Regards, Sam Knutson -----Original Message----- From: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> On Behalf Of Bill Johnson Sent: Monday, May 6, 2019 2:45 PM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: mainframe hacking "success stories"? Exactly. Sent from Yahoo Mail for iPhone On Monday, May 6, 2019, 2:43 PM, ITschak Mugzach <imugz...@gmail.com> wrote: Yes. Just logged on... And had access to all databases. This us how they was caught. Too much queries per second. בתאריך יום ב׳, 6 במאי 2019, 21:17, מאת Bill Johnson < 00000047540adefe-dmarc-requ...@listserv.ua.edu>: > The Pirate Bay hack acquired a valid mainframe userid and password off > of a Microsoft laptop. In effect, not really a mainframe hack. He just > logged on. https://badcyber.com/a-history-of-a-hacking/ > > Sent from Yahoo Mail for iPhone > > > On Monday, May 6, 2019, 1:21 PM, Charles Mills <charl...@mcn.org> wrote: > > #1: Noooooo. It was a legitimate mainframe hack (assuming you consider > USS a legitimate part of the mainframe, which it has been for 20 years or so). > It was an exploit of CGI buffer overrun. > > #2: It drives me nuts to hear mainframers explain away mainframe breaches. > "It wasn't really a mainframe hack, they got in through USS." "It > wasn't really a mainframe hack, they re-used a Windows password." "It > wasn't really a mainframe hack ... whatever." If your CEO was standing > in front of the press explaining how your company let x million credit > card numbers go astray, would it matter HOW they got into your > mainframe, or only that they DID?" If your mainframe is vulnerable to > a USS hack, or a shared Windows password, or whatever, you need to fix > THAT, or risk having to explain to your CEO why he got fired (like > Target's) for letting all those credit card numbers go astray. > > Charles > > > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] > On Behalf Of Bill Johnson > Sent: Sunday, May 5, 2019 10:00 AM > To: IBM-MAIN@LISTSERV.UA.EDU > Subject: Re: mainframe hacking "success stories"? > > Wasn’t really a mainframe hack. It was a laptop hack that acquired > legitimate mainframe credentials. > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, send > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > > > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, send > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN The contents of this e-mail are intended for the named addressee only. It contains information that may be confidential. Unless you are the named addressee or an authorized designee, you may not copy or use it, or disclose it to anyone else. If you received it in error please notify us immediately and then destroy it ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
