Slashdot Mirror
Top Cyber Attack Vectors For Critical SAP Systems
An anonymous reader writes: Despite housing an organization's most valuable and sensitive information, SAP systems are not protected from cyber threats by traditional security approaches. Based on assessments of hundreds of SAP implementations, the Onapsis Research Labs study found that over 95 percent of SAP systems were exposed to vulnerabilities that could lead to full compromise of the company's business data and processes. Most companies are also exposed to protracted patching windows averaging 18 months or more. In 2014 alone, 391 security patches were released by SAP, averaging more than 30 per month. Almost 50 percent of them were ranked as "high priority" by SAP.
Cow say moo. MOOOOOOOOO! Mooo cows! MOOOOOOOO! Moo says a cow. YOU COWS!!
That implies that there is some sort of protection while leaving out the word "traditional" implies the more correct situation where they are not protected at all.
That not necessarily a bad thing so long as the practice is to secure their stuff with third party approaches afterwards (eg. need to get on a secured VPN before you can communicate with the software).
Even from the summary, the stupidity just comes right at you, oozing like it does. There is really one cyberreason why cyberSAP is cybertraditionally cybervulnerable to cyberattack cybervectors. It's networked. It's the cyber, baby. The thing ass-u-mes a trustworthy network and is not fit to connect to anything else whatsoever. Too bad, big spender enterprises, you really do have to build a separate network for this.
I used to be active in the hacking scene and I know that there are a lot more system out there that are very vulnerable to attack
What the H* is a SAP system?
Hm.. So the research lab of a company that secures SAP for a living has found that nearly all SAP systems in the world are insecure.
Just sayin'..
For everyone who is wondering what SAP is:
http://yourfinancebook.com/what-is-sap
When will the PHBs realise that the golf course is not a 'reputable source' for software?
Having recently done a pentest for a client that uses SAP, they were a fucking mess.
SAP can be difficult and terribly sticky to work with at times. SAP can be especially troublesome if the trunk is attacked from an outside vector. Once security is breached some samples will just continue to leak, even the ones claimed to be self healing can be troublesome. It is often necessary to deploy TERPs for thorough cleanup of equipment. In conclusion, pine can have a tremendous amount of SAP. It gets all over your 'Saw And Pruners' (SAP) as you work, and makes a horrible mess.
Pine beetles are the #1 threat to sap in the layer 8 domain.
As a SAP architect for over 15 years, I can tell you definitively that this article is one big troll. Responsible architecture never exposes SAP systems to the outside world without a dedicated hardened third-party product in between. As far as the article’s points:
1) Portals: The portal product runs behind Apache and a J2EE product. Like 50% of the web, these products are very safe. I don’t understand the argument about “backdoor” users. Do they mean “system accounts”, accounts that can never have a dialog login session? If they do, then they should have done enough homework to know that all accounts on SAP systems have lockout protocols on par with industry security standards. This whole argument about portals is bogus.
2) Proprietary protocols: Yes, SAP systems do have proprietary protocols, such as RFC, ALE, SOA, etc. Though, these are never exposed to the outside world. Then, from even the inside, these are usually protected by STRUST, a certificate based trust service, and then secondarily by password. Again, you cannot get to it if it is behind a VPN and even if you could, you don’t have the certificate and would lockout any accounts trying.
3) Pivoting between sap systems: So the argument is that if you can hack and gain access to a low priority box that you now have unfettered access to an ERP? No, not going to happen. Security between systems is always sandboxed to minimize access. For example, gaining access to a SAP Business Objects server will gain you the ability to call BAPIs which still require certificates and passwords on the ERP/BW box. Portals are setup the same way. In short, even if you could defeat apache, account management, and other 3rd party barriers, you have absolutely nothing because the level of trust setup system to system is not enough to even login.
Alright net-security.org, do your homework next time.
What a useless article. The only content is that evil hackers leverage vulnerabilities to gain access to companies' SAP systems. Well, no shit sherlock. SAP is a mess and barely works under normal conditions, so anybody VP-level and above freaks out at the mere mention of touching anything on them. Of course they're going to have patching windows > 18 months.
the vulnerabilities are most likely in the operating systems/database/web servers etc. SAP, of course, runs on top of all that. The SAP software itself is not insecure but there are a lot of moving parts :-)
"over 95 percent of SAP systems" are admined and operated by complete chuckleheads.
If you are running SAP external security really is not your primary problem.
I would worry much more about SAP's well known tendency to eat any company from within until it finally bankrupt it.
It's like living on a Roc egg...
I think you mean GLOBAL for all.