Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

3/16/2017
12:30 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

ERP Attack Risks Come into Focus

New highly critical SAP vulnerability highlights dangers against critical business software.

Several developments this week recentered the security spotlight on some of the enterprise's most critical business systems as cybersecurity experts deal with the reality that enterprise resource planning (ERP) software needs heightened attention.

On the vulnerability front, SAP this week patched a new, highly critical vulnerability for SAP HANA with one of the highest severity ratings available. Meanwhile, a new survey report shows that security professionals are finally waking up to the fact that attackers are looking to leverage vulnerabilities like these, with indicated expectations of increased ERP attacks in the near future.

SAP HANA is an in-memory data platform used by enterprises to crunch data from across their business software stacks. Organizations use it to perform advanced analytics that inform critical business processes and fuel innovative applications, and as such it contains some of the most sensitive data pertaining to customers, business processes and intellectual property.  

The major vulnerability was discovered by ERP security firm Onapsis in SAP HANA's User Self-Service component and scored a CVSS vulnerability rating of 9.8, garnering a Hot News designation in this month's SAP Security Notes. If exploited, it would allow full remote compromise without access to any credentials.

"This level of access would allow an attacker to perform any action over the business information and processes supported by HANA, including creating, stealing, altering, and/or deleting sensitive information," says Sebastian Bortnik, head of research for Onapsis. "If these vulnerabilities are exploited, organizations may face severe business consequences."

According to Alexander Polyakov, CTO of ERPScan, this is definitely a big issue - but enterprises prioritizing ERP vulnerabilities should take the news with a grain of salt.

"The risk of these SAP HANA vulnerabilities is critical indeed," he says. "However, the likelihood of mass-exploitation is low as SAP HANA User Self-Service which contains the most dangerous issue is enabled only on 13% [of] Internet-exposed SAP systems according to a custom scan" by ERPScan, he says.

SAP patched the problem in this month's round of SAP Security Notes, which included 35 vulnerabilities across its portfolio. Among them there were eight vulnerabilities with a high priority rating.

Polyakov says his researchers are planning on drawing additional industry scrutiny on a critical vulnerability in the SAP GUI client, which he says has a much broader install base and could impact millions of SAP users. He says they're waiting to disclose technical information to enable SAP customers time to patch the vulnerability, but that the industry can look for details to come out of Troopers, a European security conference next week that will feature a special track on SAP security.

While there is a lot of work left to go, ERP security has increasingly hit the radar of enterprise security teams in the past few years.

"Just a few years ago, ERP security associated with separation of duties only and was hardly known even among cybersecurity experts," Polyakov says. "Nowadays, leading analysts consider it as an increasingly important topic and ERP vulnerabilities are covered by the international media."

Last year, the threats posed by these vulnerabilities tipped over from the theoretical realm to one of documented reality when US-CERT released a report that warned of at least 36 organizations worldwide impacted by attacks that leveraged a vulnerability in SAP's Invoker Servlet functionality running on SAP Java platforms.

This week, a new report from Crowd Research Partners found that 89% of security experts anticipate more attacks against ERP systems. Approximately 1 in 3 experts expect a significant increase in these attacks.

As things stand, most enterprises are still dreadfully unprepared for any attacks, let alone an increased volume of them. A report last year from Ponemon Institute showed that more than half of enterprises admit it would take their firm a year or longer to detect a breach in the SAP platform.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.