Slashdot Mirror

← Back to Stories (view on slashdot.org)

Vulnerable SAP Deployments Make Prime Attack Targets

Posted by timothy on from the don't-be-such-a-sap dept.

wiredmikey writes "Using a combination of TCP scans and Google, security researchers found that nearly a quarter of the organizations running vulnerable versions of SAP are tempting fate by leaving them exposed to the Internet. This discovery, researchers from ERPScan say, dispels the myth that SAP systems are only available from the internal network, leading to the misconception that they are protected by design. By March 2012, there were more than 2,000 security advisories published by SAP. Of those, about 7% (124) have publicly available PoC (proof-of-concept) exploit code available to the public. Many of the issues discovered are related to poor configuration or poor deployment planning. For example, 212 SAP Routers were found in Germany, which were created mainly to route access to internal SAP systems. Another issue with the vulnerable and exposed SAP installations is that many of them run on Windows NT, creating a twin set of risks for the organization, as they have to contend with a bad SAP deployment and unsupported OS that is full of security issues all by itself."

5 of 72 comments (clear)

  1. Bad by Dan+East · · Score: 3, Insightful

    I have no idea what the hell SAP is, but it sounds really dangerous.

    --
    Better known as 318230.
    1. Re:Bad by MtHuurne · · Score: 5, Insightful

      Indeed, it's one of those systems that is so expensive that its deployment has to be declared a success or the person who authorized it will be in trouble.

  2. Re:where can i download a trial version of SAP? by cvtan · · Score: 3, Insightful

    If you are an individual, you don't want it and if you are a company, you REALLY don't want it.

    --
    Sorry, but gray text on gray background is making my eyes bleed.
  3. Re:Windows NT?? Really? It's 2012! by Guy+Harris · · Score: 4, Insightful

    Having only grazed over the article, Windows NT is Microsoft's current flagship operating system. Windows NT 6.1 being their latest "stable" release marketed under the names Windows 7 and Windows Server 2008 R2

    But if they really meant "Windows NT" as in Windows NT 4.0, then I agree, that is pretty darn bad

    Given that the paper from ERPScan lists the OSes atop which SAP runs as "Windows NT", "AIX", "Linux", "SunOS", "HP-UX", and "OS/400", I suspect that when they say "Windows NT" they mean, as you suggest, "Windows NT the family of operating systems, older ones of which were sold under the name "Windows NT" and newer versions of which aren't", not "Windows NT 3.x and 4.0", i.e. Windows Server 20xx (and Windows 2000/XP/Vista/7, if anybody's running it on their desktop) are lumped under "Windows NT" (and Solaris N is lumped under "SunOS").

  4. Re:Windows NT?? Really? It's 2012! by Anonymous Coward · · Score: 1, Insightful

    Also, both XP & 2003 can be set to the "classic" interface which makes it look like windows 2000.

    When they say "unsupported OS that is full of security issues all by itself." they're referring the the current versions of NT - Versions 5 and above.

    The "unsupported OS" proviso is just to point out that they're experienced Microsoft customers and are familiar with their support team.