Mainframes Hackable, But Do You Care?Mainframes may have holes, but they aren't big targets
There have been very few database security presentations at security conferences of late, as SQLi and buffer overflow attacks have lost their novelty. That said, there is a lot of very interesting database security research going on. and I was lucky to proctor Philip Young's presentation at Blackhat USA 2013 on Mainframes: The Past Will Come Back to Haunt You. In a nutshell, Philip identified several behavioral issues that have serious security implications:
1. It was easy to find valid user accounts as the login sequence leaks information.
2. Passwords are short, don't require complexity, and relatively trivial to crack.
3. Mainframes come with a supplementary UNIX environment.
4. FTP automatically executes uploaded files (data sets).
All of which leads to fun and mayhem for an attacker, and potentially serious data breaches. But does anyone care? The presentation and -- given most of my mainframe experience was OS390 -- educational, will this public research yield increased attacks against zOS?
I asked a well-known database vulnerability researcher last year "Why don't we hear about more DB2 hacks?" His response: "Because no one uses it."
The point he was making was that, in comparison to Oracle and SQL Server, DB2's market size is relatively small. The response may sound glib, but I see very few new -- Web or otherwise -- projects on any flavor of DB2, and certainly not mainframe. We said for years that Mac OS-X was "safe" from a security standpoint as it's market presence was minuscule compared to Windows. It did not warrant attackers focus as the reward vs. effort factor was out of whack. Mainframes, while still alive and running critical applications for the indefinite future, do not attract attackers, as it would require investment of a few hundred hours to understand, and access to a mainframe (emulator).
All of which is my way of saying that you, the person responsible for mainframe database security, don't have a lot to worry about. And if you were worried about these attacks, you can disable FTP to thwart malicious code uploads. Or firewall off the mainframe from Web access, as seems common. Beyond that most of the flaws must be addressed by IBM through code changes.
Adrian Lane is an analyst/CTO with Securosis LLC, an independent security analyst firm. Special to Dark Reading.
Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio