Slashdot Mirror
Attackers Targeting Critical SAP Flaw Since 2013 (threatpost.com)
msm1267 quotes a report from Threatpost: Three dozen global enterprises have been breached by attackers who exploited a single, mitigated vulnerability in SAP business applications. The attacks were carried out between 2013 and are ongoing against large organizations owned by corporations in the United States, United Kingdom, Germany, China, India, Japan, and South Korea, spanning 15 critical industries, researchers at Onapsis said today. [The DHS-sponsored CERT at the Software Engineering Institute at Carnegie Mellon University also published an alert this morning, the first in its history for SAP applications.] The severity of these attacks is high and should put other organizations on notice that are running critical business processes and data through SAP Java apps. The issue lies in the Invoker Servlet, which is part of the standard J2EE specification and enables developers to test custom Java applications. When it is enabled, developers and users can call these servlets over the Internet directly without authentication or authorization controls. Attackers, however, can take advantage of this same functionality to exploit these business critical systems.
It's not like anyone can actually locate information in SAP in the first place. Could take decades for an outsider to figure out a business relationship, or the companies cost for something when you include the lag time for a simple query.
Most companies above a certain size run a type of software called "Enterprise Resource Management" or "ERP". The functionality is a bit nebulous, but it can include everything from purchasing to HR, inventory, ordering, fulfillment, etc. It's the software that essentially runs the business. There are lots of ERP systems out there, but SAP is a very very big (probably the biggest) one. There's probably some statistic about X% of fortune 500 companies use SAP as their ERP system. It's kind of notorious for being 1) expensive to license, 2) expensive to customize, 3) expensive for users to be trained on, and 4) generally sold more on the pretty graphs management gets to see rather than on the usefulness it brings to the company. Good developers who know SAP customization are paid a lot of money. Typical SAP implementations for a large business will run into the millions of dollars easily.
"I have never let my schooling interfere with my education." - Mark Twain
A.mishmash of technologies jammed together onto one platform that sells for millions. Expect to pay through the nose.
Traditional big iron shops have COBOL and DB2 on the back end processing millions of transactions per day on IBM mainframes running zOS or OS390 with midrange servers hosting java apps for the modern web interface, or CICS on the mainframe is their asses are not in gear.
Mixed in are a bunch of tools to support this.
Now. SAP. In the 1970s some dudes from IBM saw COBOL and DB2, said "what a bunch of shit! We can do better" and left IBM to develop their own tech. ABAP is a language which looks smells and feels like COBOL. The only difference is that the lifecycle promotion paths and environmental packaging and controls are stuck in the 70s. ABAP is effectively COBOL. HANA is the database the SAP guys dreamed up to combat DB2. It hasn't won yet. Give it time. They have yet to get out of the 90s in comparison with DB2. The SAP midrange machines run java jvms. Yay. Good on you guys for integrating java into the SAP stack.
There are a bunch of tools to support all of this.
The SAP guys then built some very crappy business software, ERP CRM etc - look it up ' for one client which they then adapted for selling to multiple clients. Their business model is to rock up to organisations paying millions to IBM and microsoft and say: Pour your databases into SAP Hana, convert your code and business rules to ABAP and pay us millions for licences. It will be better! One vendor! One database! What could possibly go wrong? It has to be better than COBOL! Mainframes are old tech! Go midrange! Don't be vendor locked! Come! Join us!
The stupid part is that they expect all data to be poured into their existing systems. ERP. CRM. Etc. Don't ever get anyone started on their business modelling tools and their grand plan to put all programmers out of work because the BA can code the business logic easily using the GUI.
The invoker servlet and its default mapping /servlet/* isn't present in old nor current specs. It is not a JEE standard or was. It was a feature many JEE containers copied mainly because Tomcat at that time was the reference implementation (The invoker servlet class was on the tomcat package namespace not on the javax.servet one) , a very bad idea. It is not present in modern containers.
Since 2002 is known that having it enabled was a bad idea. But you know, enterprise software is badly updated.
So if I work for a business that uses SAP, is there a way for me to find out if it's patched and if my personal information is safe?
Maybe. Send Another Payment and we'll open a support case with your partner. Once we have the signed work order, we get agrement on the scope of the work and begin.
And remember: Send Another Payment.