Vulnerabilities / Threats
7/25/2013
06:37 AM
John H. Sawyer
John H. Sawyer
Quick Hits
Connect Directly
RSS
E-Mail
50%
50%

How Attackers Target And Exploit Critical Business Applications

Applications such as ERP and CRM make businesses go, yet are often left unpatched and vulnerable

[The following is excerpted from "How Attackers Target and Exploit Critical Business Applications," a new report posted this week on Dark Reading's Applications Security Tech Center.]

Most enterprises rely on a few critical business applications for their day-to-day operations. Many of these applications are well-known, off-the-shelf or cloud-based products. Because of their critical nature and the value of the data contained within them, they are a prime target for attackers.

So why don't we hear more about attacks against enterprise resource planning systems, sensitive e-commerce and business-to-business applications, and customer resource management systems? The primary reason is that enterprises don't see them as being insecure. Also, their complexity makes it difficult to effectively monitor them and detect a compromise.

Even if such systems could be easily monitored, the collective experience in the 2013 Verizon Data Breach Investigations Report tells us that it would probably take months for anyone to notice the breach. Further, notes the report, notification is more likely to come from a third party than from internal monitoring.

But attackers are targeting these systems, and security professionals will need to up their game as targeted attacks and corporate espionage become more prevalent.

In the white paper "Forgotten World: Corpo-rate Business Application Systems," authors Alexander Polyakov and Val Smith say, "These days the majority of companies have strong security policies and patch management as it applies to standard networks and operating systems, but these defenses rarely exist or are in place for ERP-type systems. An attacker can bypass all company investments in security by attacking the ERP system."

It's the very nature of ERP and other enterprise apps that makes them so appealing to attackers.

These systems are complex, customized applications that house the inner workings of the business itself. In order to work effectively, these mega business applications typically have connections into, and receive input from, many different applications and servers throughout the enterprise. These systems are not turnkey, almost always requiring some type of middleware glue from a consulting company. All of these factors make for a-difficult- to-secure and nearly impossible-to-patch system.

Even if these systems were easy to patch, the vulnerabilities would likely go unnoticed because companies are often afraid to perform vulnerability scans on them: There are too many unknowns in how the systems would handle such a scan, and they don't want to impact business operations.

Part of the pushback that occurs around scanning running applications is that those organizations with a strong focus on application security have tended to throw their resources at the front-end of the application life cycle, says John Weinschenk, CEO of Cenzic. While that may be the most cost-effective method of addressing application security, the truth is that it doesn't address the realities of applications running in a production environment

"When you look at an enterprise, traditionally how they have handled application security has been focused at the pre-production level," he says. "But with every company that's been hacked that you've seen in the paper recently, its always the production applications that got hacked."

While this fear of scanning operational applications may be understandable to a point, it leaves some of your most critical systems at risk.

To read more about the challenges of maintaining and securing critical business applications -- and how attackers exploit those applications -- download the free report.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon6678820158
50%
50%
anon6678820158,
User Rank: Apprentice
7/29/2013 | 1:09:25 AM
re: How Attackers Target And Exploit Critical Business Applications
Firms have to evaluate the IA issues of the system they are buying into. No longer can company's trust that a vendor will secure their data. IT security should be involved in the vetting process for these systems.
anon7187962634
50%
50%
anon7187962634,
User Rank: Apprentice
7/26/2013 | 6:50:11 AM
re: How Attackers Target And Exploit Critical Business Applications
It's funny, I'm no longer working for a firm that was having MAJOR issues with CRM security (actually, the mass-emailing program). Since CRM is deemed (incorrectly) a "Marketing Application," IT always ignored it as much as possible. We became blacklisted because of insecure sending of emails, and the dipsh*t IT person said, "Well, why don't we just ad an 's' to our urls to make them read 'https' and then we'll be 'secure'."

With morons like that - and the continued thinking that CRM is somehow 'safe' because it's just a Marketing app - it's no wonder that CRM poses a threat.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.