Application Security //

Database Security

3/16/2017
12:30 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
100%
0%

ERP Attack Risks Come into Focus

New highly critical SAP vulnerability highlights dangers against critical business software.

Several developments this week recentered the security spotlight on some of the enterprise's most critical business systems as cybersecurity experts deal with the reality that enterprise resource planning (ERP) software needs heightened attention.

On the vulnerability front, SAP this week patched a new, highly critical vulnerability for SAP HANA with one of the highest severity ratings available. Meanwhile, a new survey report shows that security professionals are finally waking up to the fact that attackers are looking to leverage vulnerabilities like these, with indicated expectations of increased ERP attacks in the near future.

SAP HANA is an in-memory data platform used by enterprises to crunch data from across their business software stacks. Organizations use it to perform advanced analytics that inform critical business processes and fuel innovative applications, and as such it contains some of the most sensitive data pertaining to customers, business processes and intellectual property.  

The major vulnerability was discovered by ERP security firm Onapsis in SAP HANA's User Self-Service component and scored a CVSS vulnerability rating of 9.8, garnering a Hot News designation in this month's SAP Security Notes. If exploited, it would allow full remote compromise without access to any credentials.

"This level of access would allow an attacker to perform any action over the business information and processes supported by HANA, including creating, stealing, altering, and/or deleting sensitive information," says Sebastian Bortnik, head of research for Onapsis. "If these vulnerabilities are exploited, organizations may face severe business consequences."

According to Alexander Polyakov, CTO of ERPScan, this is definitely a big issue - but enterprises prioritizing ERP vulnerabilities should take the news with a grain of salt.

"The risk of these SAP HANA vulnerabilities is critical indeed," he says. "However, the likelihood of mass-exploitation is low as SAP HANA User Self-Service which contains the most dangerous issue is enabled only on 13% [of] Internet-exposed SAP systems according to a custom scan" by ERPScan, he says.

SAP patched the problem in this month's round of SAP Security Notes, which included 35 vulnerabilities across its portfolio. Among them there were eight vulnerabilities with a high priority rating.

Polyakov says his researchers are planning on drawing additional industry scrutiny on a critical vulnerability in the SAP GUI client, which he says has a much broader install base and could impact millions of SAP users. He says they're waiting to disclose technical information to enable SAP customers time to patch the vulnerability, but that the industry can look for details to come out of Troopers, a European security conference next week that will feature a special track on SAP security.

While there is a lot of work left to go, ERP security has increasingly hit the radar of enterprise security teams in the past few years.

"Just a few years ago, ERP security associated with separation of duties only and was hardly known even among cybersecurity experts," Polyakov says. "Nowadays, leading analysts consider it as an increasingly important topic and ERP vulnerabilities are covered by the international media."

Last year, the threats posed by these vulnerabilities tipped over from the theoretical realm to one of documented reality when US-CERT released a report that warned of at least 36 organizations worldwide impacted by attacks that leveraged a vulnerability in SAP's Invoker Servlet functionality running on SAP Java platforms.

This week, a new report from Crowd Research Partners found that 89% of security experts anticipate more attacks against ERP systems. Approximately 1 in 3 experts expect a significant increase in these attacks.

As things stand, most enterprises are still dreadfully unprepared for any attacks, let alone an increased volume of them. A report last year from Ponemon Institute showed that more than half of enterprises admit it would take their firm a year or longer to detect a breach in the SAP platform.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cloud Security's Shared Responsibility Is Foggy
Ben Johnson, Co-founder and CTO, Obsidian Security,  9/14/2017
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.