Layer Seven Security

DHS Issues Warning for Cyber Attacks Targeting SAP Applications

The United States Department of Homeland Security issued a warning this week for malicious cyber activity targeting ERP applications including SAP. The warning is based on the findings of a recent report issued by Digital Shadows and Onapsis. The report discusses the dramatic rise in cyber attacks on widely used ERP applications. The report echoes the findings of an earlier study by Gartner that predicted a growth in attacks targeted at business applications.

The findings of the report are summarized below.

– The number of publicly available exploits for SAP applications has doubled in the past three years and there has been a 160% increase in the activity and interest in ERP-specific vulnerabilities between 2016-17

– Hacktivist groups are actively attacking ERP applications to disrupt critical business operations and penetrate target organizations

– Cybercriminals have evolved malware to target internal, “behind-the-firewall” ERP applications

– Nation-state sponsored actors have targeted ERP applications for cyber espionage and sabotage

– There has been a dramatic increase in the interest in exploits for SAP applications, including SAP HANA, in dark web and cybercriminal forums

– Attacks vectors are evolving, still mainly leveraging known ERP vulnerabilities vs. zero-days

– Cloud, mobile and digital transformations are rapidly expanding the ERP attack surface, and threat actors are taking advantage.

– Leaked information by third parties and employees can expose internal ERP applications.

In response, the report recommends the following actions to protect SAP applications from cyber attack.

– Identify and mitigate ERP application layer vulnerabilities, insecure configurations and excessive user privileges

–  Identify and remove dangerous interfaces and APIs between the different ERP applications in the organization, especially those with third parties and that are internet-facing

–  Monitor and respond to sensitive ERP user activity and ERP-specific indicators of compromise

–  Monitor for leaked ERP data and user credentials

The recommended actions can be applied using SAP Solution Manager. System and user-level vulnerabilities can be identified using Service Level Reporting and Dashboards in Solution Manager. System Recommendations can be used to discover and apply security patches. Vulnerable cross-system connections including external connections can be discovered and monitored using Interface and Connection Monitoring (ICMon). The Monitoring and Alerting Infrastructure (MAI) in Solution Manager can be used to monitor SAP logs to detect indicators of compromise including the leakage of sensitive data. Finally, the Guided Procedure Framework provides a platform for incident response using standard operating procedures for alert investigation.

 

SAP Security Notes, June 2018

Hot News Note 2622660 includes critical security updates for web browser controls delivered with SAP Business Client. The Client provides a unified environment for SAP applications including Fiori, SAP GUI, and Web Dynpro.  It supports browser controls from Internet Explorer (IE) and Chrome for displaying HTML content. Security corrections for the WebBrowser control of the .NET framework in IE are delivered directly by Microsoft. Unlike IE, the browser control for Chrome is embedded in SAP Business Client using the open source Chromium Embedded Framework (CEF). Security fixes are provided by the Chromium project and delivered by SAP through periodic Security Notes.  Note 2622660 was updated in June for corrections addressed by Chromium release 67.0.3396. The critical rating of the note is due to the fact that the highest CVSS rating of the security corrections bundled in the fixes is 9.8/10.

Note 2537150 was also re-released with updated support pack information. The Note includes corrections to automatically terminate active sessions for users whose passwords have been changed in SAP BusinessObjects.

Notes 2629535 and 2626762 patch high-risk vulnerabilities in open-source components bundled in SAP Internet Sales. The vulnerabilities could be exploited to provoke a denial of service or bypass authentication and authorization controls. SAP Internet Sales is often tightly integrated with back-end SAP systems for order fulfillment and processing.

Finally, there were several important notes released for SAP Solution Manager. Note 2546807 provides manual instructions for successfully connecting agents for Wily Introscope to managed systems. Introscope is included in Solution Manager to support diagnostics and monitoring.  Note 2574394 includes steps for authenticating and encrypting connections from Solution Manager to Diagnostics Agents using TLS. Instructions for securing connections from Diagnostics Agents to Solution Manager are available in Note 2593479.