Hector Martin

The more I look at AWS and the more I cannot understand how IBM missed the opportunity of using massive zSeries installs with Linux LPARs for cloud computing. All the I/O, security, etc. problems had already been solved. CloudHSM? Ha, z15-TO1 & friends, I/O? Ha… mainframe!

If you think mainframes fundamentally solve security problems, we need to have a word about exploit mitigations in z/OS (or lack thereof). mainframes are equally or less secure than commodity x86. It's just that there are probably 2 people in the world trying to exploit them.

Did you count me in or not? I spent quite some time hacking LPARs to little success, less now as I lost access to my hacking target, probably my incompetence but they actually had thought of stuff far more than x86.

I wrote a trivial buffer overflow CTF level on z/OS USS, exploitable by dumping shellcode on the stack and overwriting the return addr. The kind of thing that hasn't worked on x86 for two decades... I mean, LPARs work, but so does Intel virtualization...

I’m talking z/VM and LPARs in which you run Linux, z/OS is something different. Breaking that is more interesting from a rewards perspective… z/OS tools almost certainly have a gazillion vulnerabilities like anything Linux, Windows, macOS. The underlying hardware is better.