Re: ransomware on z

2023-08-12 Thread ITschak Mugzach
I used the generic term DS8000, but I don't recall the exact device type. I think that, as other mentioned, the point is that you do not need to access the mainframe itself in order to damage the data. ITschak ITschak Mugzach *|** IronSphere Platform* *|* *Information Security Continuous

Re: ransomware on z

2023-08-12 Thread Bob Bridges
I've a favorite author who points out that criminals mostly are optimists. They think everyone else is a sucker and they're smarter than everyone else, they therefore think they can't get caught, and they risk 12 years in prison for a haul they could get with a mere eight months of honest work.

Re: ransomware on z

2023-08-12 Thread Bob Bridges
If we're still talking about the Logica hack, the reading I did on it says they got their hands on an ID that had read access to the RACF database. So the initial entry was the same as it almost always is; someone was careless with a password. After that they did other things, mostly in OMVS

Re: TRSMAIN AMATERSE

2023-08-12 Thread kekronbekron
Is the **algorithm** documented... you know, in words, with examples? --- Original Message --- On Saturday, August 12th, 2023 at 10:21 PM, Erik Janssen wrote: > See: > https://github.com/openmainframeproject/tersedecompress > > Kind regards, > Erik. > > > On Sat, 12 Aug 2023

Re: TRSMAIN AMATERSE

2023-08-12 Thread kekronbekron
Is LZW the exact same as TRSMAIN/AMATERSE? --- Original Message --- On Sunday, August 13th, 2023 at 1:42 AM, Farley, Peter <031df298a9da-dmarc-requ...@listserv.ua.edu> wrote: > At a guess, in the IBM and Unisys patent files that have expired at the US > Patent Office. Not sure if

Re: The ultimate (another one!) definition of mainframe

2023-08-12 Thread Mike Schwab
Actually, Microsoft, run by thr son of an IBM employee, was approached, and was referred to Digital Research's CPM for 8080, port to 8086/8088 was not ready. They sold it at $200.00 a copy, which IBM was not willing to pay. The license specified if the price was lowered, existing purchaser would

Re: Automount (was USS Features)

2023-08-12 Thread Grant Taylor
On 8/7/23 10:11 AM, Paul Gilmartin wrote: Instead of a home directory for each user with Documents, etc. subdirectories there's a global Documents directory with subdirectories for individual users. Which version of Windows are you talking about. Did something MASSIVELY change in Windows

Re: USS Features

2023-08-12 Thread Grant Taylor
On 8/7/23 9:56 AM, Jon Perryman wrote: It's absurd to allow everyone to do Proof Of Concept on z/OS. Are all POC vital to the business? Are POCs disruptive to the business? These statements cause me to pause. They seem somewhat antithetical to welcoming and encouraging people to use the

Re: The ultimate (another one!) definition of mainframe

2023-08-12 Thread Grant Taylor
On 8/7/23 12:26 PM, Jon Perryman wrote: Was it a smart decision for IBM to sell the software that became Microsoft? Please clarify what IBM sold to Microsoft. My understanding is that Microsoft, an existing but small company, came to IBM and said "here, we have an operating system for the

Re: ransomware on z

2023-08-12 Thread Peter Bishop
Agreed, and it's not shown how it fits into the category of "ransomware" either. cheers, Peter On 13/08/2023 10:00 am, Tony Thigpen wrote: I still think that the store is BS because the script could not be ran remotely during the time-frame the  story was stated to have occurred in. Other

Re: TRSMAIN AMATERSE

2023-08-12 Thread Charles Mills
Claimed implementations here in many languages, including C, PL/I and Rexx. https://rosettacode.org/wiki/LZW_compression CM On Sat, 12 Aug 2023 17:20:47 -0400, Tony Harminc wrote: >On Sat, 12 Aug 2023 at 09:30, kekronbekron ><02dee3fcae33-dmarc-requ...@listserv.ua.edu> wrote: >> >> From

Re: ransomware on z

2023-08-12 Thread Tony Thigpen
I still think that the store is BS because the script could not be ran remotely during the time-frame the story was stated to have occurred in. Other things in the store don't make sense. It's either BS or the hacker was given special access to the facility. Tony Thigpen Grant Taylor wrote

Re: ransomware on z

2023-08-12 Thread Grant Taylor
On 8/12/23 4:49 PM, Tony Thigpen wrote: You can not run that script remote without the Remote-CE option enabled. And, that option was not available until the DS8870. And, to run it you have to first log in as CE. A password that should have been changed at installation. Do you want to hang

Re: TRSMAIN AMATERSE

2023-08-12 Thread Paul Gilmartin
On Sat, 12 Aug 2023 20:12:32 +, Farley, Peter wrote: >At a guess, in the IBM and Unisys patent files that have expired at the US >Patent Office. Not sure if USPO requires any payment to view/print patent >files, but they are supposed to be “public record” so should be available. > >For

Re: ransomware on z

2023-08-12 Thread Tony Thigpen
Well, I will be the one to call this story BS. You can not run that script remote without the Remote-CE option enabled. And, that option was not available until the DS8870. And, to run it you have to first log in as CE. A password that should have been changed at installation. Tony Thigpen

Re: TRSMAIN AMATERSE

2023-08-12 Thread Tony Harminc
On Sat, 12 Aug 2023 at 09:30, kekronbekron <02dee3fcae33-dmarc-requ...@listserv.ua.edu> wrote: > > From the thread... > > "The algorithm is reasonably well documented, and the encapsulation is not > complex. And > as I said, the patents have expired." That was me writing, 15 years ago. >

Re: ransomware on z

2023-08-12 Thread ITschak Mugzach
Agree. my point is that a mainframe is just another server and that you don't need to login into to damage the data. ITschak ITschak Mugzach *|** IronSphere Platform* *|* *Information Security Continuous Monitoring for z/OS, x/Linux & IBM I **| z/VM coming soon * On Sat, Aug 12, 2023 at

Re: TRSMAIN AMATERSE

2023-08-12 Thread Charles Mills
I have a lot of personal experience with the LZW patent, up to and including paying royalties to Unisys. I will not bore this group with my whole long story. Suffice it to say that this was one of the first "stealth" patents. At the time I implemented and used the algorithm there was no public

Re: ransomware on z

2023-08-12 Thread Charles Mills
The long periods of bad guy access are typical. You read most of the breach stories the attack unfolded over weeks or months. The hackers talk about pwning (owning) a group of servers. CM On Sat, 12 Aug 2023 16:13:12 -0400, Phil Smith III wrote: >ITschak Mugzach wrote, in part: >>Remember

Re: ransomware on z

2023-08-12 Thread Phil Smith III
ITschak Mugzach wrote, in part: >Remember that when pirate bay penetrated Logica, he had >no clue on mainframes, but was able to stay for almost 1.5 years. This falls into the category of "things I just don't get": if that had been me, I'd've woken up every single morning wondering if this was

Re: TRSMAIN AMATERSE

2023-08-12 Thread Farley, Peter
At a guess, in the IBM and Unisys patent files that have expired at the US Patent Office. Not sure if USPO requires any payment to view/print patent files, but they are supposed to be “public record” so should be available. For Lempel-Ziv-Welch compression, Wikipedia article here:

ransomware on z

2023-08-12 Thread ITschak Mugzach
Few days ago, I don't remember who and if it was here or at racf-l, someone asked about a known case of a mainframe ransomware attack by encrypting the disks. Few years ago we performed a whitehat attack at a large insurance company. WE started with the DS8xxx HMC server. A short RTFM showed that

Re: TRSMAIN AMATERSE

2023-08-12 Thread Erik Janssen
See: https://github.com/openmainframeproject/tersedecompress Kind regards, Erik. On Sat, 12 Aug 2023 05:19:43 +, kekronbekron wrote: >By any chance, is the algorithm for tersing/untersing publicly available? > >-- >For

Re: TRSMAIN AMATERSE

2023-08-12 Thread kekronbekron
>From the thread... "The algorithm is reasonably well documented, and the encapsulation is not complex. And as I said, the patents have expired." Well-documented where? --- Original Message --- On Saturday, August 12th, 2023 at 5:17 PM, Mike Schwab wrote: >

Re: TRSMAIN AMATERSE

2023-08-12 Thread Steve Beaver
I doubt it Sent from my iPhone No one said I could type with one thumb > On Aug 12, 2023, at 06:47, Mike Schwab wrote: > > https://hercules-390.yahoogroups.narkive.com/gYwJ3QUu/terse-for-pcs-windows-aix-linux > > Now over at groups.io . > >> On Sat, Aug 12, 2023, 00:20 kekronbekron < >>

Re: TRSMAIN AMATERSE

2023-08-12 Thread Mike Schwab
https://hercules-390.yahoogroups.narkive.com/gYwJ3QUu/terse-for-pcs-windows-aix-linux Now over at groups.io . On Sat, Aug 12, 2023, 00:20 kekronbekron < 02dee3fcae33-dmarc-requ...@listserv.ua.edu> wrote: > By any chance, is the algorithm for tersing/untersing publicly available? > >