Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

3/16/2017
12:30 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

ERP Attack Risks Come into Focus

New highly critical SAP vulnerability highlights dangers against critical business software.

Several developments this week recentered the security spotlight on some of the enterprise's most critical business systems as cybersecurity experts deal with the reality that enterprise resource planning (ERP) software needs heightened attention.

On the vulnerability front, SAP this week patched a new, highly critical vulnerability for SAP HANA with one of the highest severity ratings available. Meanwhile, a new survey report shows that security professionals are finally waking up to the fact that attackers are looking to leverage vulnerabilities like these, with indicated expectations of increased ERP attacks in the near future.

SAP HANA is an in-memory data platform used by enterprises to crunch data from across their business software stacks. Organizations use it to perform advanced analytics that inform critical business processes and fuel innovative applications, and as such it contains some of the most sensitive data pertaining to customers, business processes and intellectual property.  

The major vulnerability was discovered by ERP security firm Onapsis in SAP HANA's User Self-Service component and scored a CVSS vulnerability rating of 9.8, garnering a Hot News designation in this month's SAP Security Notes. If exploited, it would allow full remote compromise without access to any credentials.

"This level of access would allow an attacker to perform any action over the business information and processes supported by HANA, including creating, stealing, altering, and/or deleting sensitive information," says Sebastian Bortnik, head of research for Onapsis. "If these vulnerabilities are exploited, organizations may face severe business consequences."

According to Alexander Polyakov, CTO of ERPScan, this is definitely a big issue - but enterprises prioritizing ERP vulnerabilities should take the news with a grain of salt.

"The risk of these SAP HANA vulnerabilities is critical indeed," he says. "However, the likelihood of mass-exploitation is low as SAP HANA User Self-Service which contains the most dangerous issue is enabled only on 13% [of] Internet-exposed SAP systems according to a custom scan" by ERPScan, he says.

SAP patched the problem in this month's round of SAP Security Notes, which included 35 vulnerabilities across its portfolio. Among them there were eight vulnerabilities with a high priority rating.

Polyakov says his researchers are planning on drawing additional industry scrutiny on a critical vulnerability in the SAP GUI client, which he says has a much broader install base and could impact millions of SAP users. He says they're waiting to disclose technical information to enable SAP customers time to patch the vulnerability, but that the industry can look for details to come out of Troopers, a European security conference next week that will feature a special track on SAP security.

While there is a lot of work left to go, ERP security has increasingly hit the radar of enterprise security teams in the past few years.

"Just a few years ago, ERP security associated with separation of duties only and was hardly known even among cybersecurity experts," Polyakov says. "Nowadays, leading analysts consider it as an increasingly important topic and ERP vulnerabilities are covered by the international media."

Last year, the threats posed by these vulnerabilities tipped over from the theoretical realm to one of documented reality when US-CERT released a report that warned of at least 36 organizations worldwide impacted by attacks that leveraged a vulnerability in SAP's Invoker Servlet functionality running on SAP Java platforms.

This week, a new report from Crowd Research Partners found that 89% of security experts anticipate more attacks against ERP systems. Approximately 1 in 3 experts expect a significant increase in these attacks.

As things stand, most enterprises are still dreadfully unprepared for any attacks, let alone an increased volume of them. A report last year from Ponemon Institute showed that more than half of enterprises admit it would take their firm a year or longer to detect a breach in the SAP platform.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14499
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
CVE-2020-14501
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also ...
CVE-2020-14503
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
CVE-2020-14497
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
CVE-2020-14505
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection�) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that create...