Six Degrees of RACF SPECIAL - Mainframe Attack Paths#

Jonathan Prince (independent IBM z/OS and IBM i security researcher)

• Why: Graph-based attack-path modeling is the state of the art in AD identity security — this talk exports it to RACF/z/OS, the tier-0 systems that usually sit behind the AD you already model. If you care about identity graphs, this extends them to the mainframe.
• What: RACFHound, a tool that transforms RACF authorization data into an identity graph and integrates it into BloodHound via the OpenGraph framework. Surfaces multi-step escalation paths that flat RACF reports miss: SURROGAT permission chains, write access to APF-authorized libraries, escalation through UNIX System Services, and paths to the SPECIAL and OPERATIONS attributes. Live BloodHound demo replaces hours of manual report analysis with instant graph queries.
• How: Extract RACF authorization entities (users, groups, datasets, surrogate perms, system authorities), map them to a graph model, and express z/OS-specific attack primitives as graph edges; query for shortest paths to privileged attributes.
• Where applicable: z/OS with RACF — core banking, payments, government records. Requires access to the RACF database/audit data (offensively, typically post-AD-compromise collection; defensively, from routine reports). General technique for any RACF shop; the "gap between a compromised AD account and privileged mainframe access" framing is the transferable insight. (from abstract only)