Another reason for lot of focus on white/black hat focus on USS -- that's what most of the non-mainframe world is already familiar with, lower barrier to (unauthorized) entry to mainframe. Don't know if any individual/team has/have *started* their break-the-mainframe journey from core MVS...
– Vignesh Mainframe Infrastructure -----Original Message----- From: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> On Behalf Of Mohammad Khan Sent: 07 May 2019 14:49 To: IBM-MAIN@LISTSERV.UA.EDU Subject: [EXTERNAL] Re: mainframe hacking "success stories"? USS is definitely an integral part of z/OS so it's a legitimate mainframe hack. However if more of the hacks are occurring via USS it does raise questions about its quality from security perspective compared to the "classic" MVS side of the mainframe. Buffer overruns are probably the most common exploits in the UNIX / C programming environment, did IBM just bring in all its problems as well when they implemented OMVS / USS? MKK On Mon, 6 May 2019 10:21:25 -0700, Charles Mills <charl...@mcn.org> wrote: >#1: Noooooo. It was a legitimate mainframe hack (assuming you consider USS a >legitimate part of the mainframe, which it has been for 20 years or so). It >was an exploit of CGI buffer overrun. > >#2: It drives me nuts to hear mainframers explain away mainframe breaches. "It >wasn't really a mainframe hack, they got in through USS." "It wasn't really a >mainframe hack, they re-used a Windows password." "It wasn't really a >mainframe hack ... whatever." If your CEO was standing in front of the press >explaining how your company let x million credit card numbers go astray, would >it matter HOW they got into your mainframe, or only that they DID?" If your >mainframe is vulnerable to a USS hack, or a shared Windows password, or >whatever, you need to fix THAT, or risk having to explain to your CEO why he >got fired (like Target's) for letting all those credit card numbers go astray. > >Charles > ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN MARKSANDSPENCER.COM ________________________________ Unless otherwise stated above: Marks and Spencer plc Registered Office: Waterside House 35 North Wharf Road London W2 1NW Registered No. 214436 in England and Wales. Telephone (020) 7935 4422 Facsimile (020) 7487 2670 www.marksandspencer.com Please note that electronic mail may be monitored. This e-mail is confidential. If you received it by mistake, please let us know and then delete it from your system; you should not copy, disclose, or distribute its contents to anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
