The awesome talk by @Voulnet at the Northern Security Conference (nsc.frl) discussed various techniques that are used in malware to ‘obfuscate’ the real inner workings of said malware.
One of the techniques I learned about is “doing a DNS lookup, parse the IP as characters (4 bytes per IP) and inject that into the code”.
The post-talk discussion I had with him got me wondering if this would work on The Mainframe too. Just take IPv4 addresses that are the integer representation of EBCDIC characters and bind them to a dns-entry.
My idea was that once the correct ip-addresses (that resolve to EBCDIC chars) were ‘DNS-queryable’ I could just load that into the REXX and execute it.
After a (somewhat) long night and an afternoon I came up with a reference implementation of doing just that...
