Breaking, forensicating and anti-forensicating SAP Portal and J2EE Engine
1 like988 views
The document discusses the importance of SAP security and forensic analysis, highlighting the vulnerabilities and risks associated with SAP systems. It emphasizes the need for effective monitoring and auditing practices to prevent espionage, sabotage, and fraud, while also detailing specific attack vectors and defense strategies. The presentation showcases the capabilities of Erpscan, a leading provider of SAP security solutions, and outlines common security issues faced by organizations using SAP technology.
![[Apr
3,
2013
1:23:59
AM
]
-‐
192.168.192.14
:
GET
/ctc/ConfigServlet
HTTP/1.1
401
1790
[Apr
3,
2013
1:30:01
AM
]
-‐
192.168.192.14
:
HEAD
/ctc/ConfigServlet?
param=com.sap.ctc.u8l.UserConfig;CREATEUSER;U
SERNAME=ITWEB,PASSWORD=ITWEB
HTTP/1.0
200
0
32
Verb
Tampering:
Forensics](https://image.slidesharecdn.com/2013itweb-150623150805-lva1-app6892/85/Breaking-forensicating-and-anti-forensicating-SAP-Portal-and-J2EE-Engine-32-320.jpg)
![#1.5#000C29C2603300790000003A000008700004D974E7CCC6D8#1364996035203#/System/Security/
Audit#sap.com/tc~lm~ctc~util~basic_ear#com.sap.security.core.util.SecurityAudit#Guest#0#SAP
J2EE Engine JTA Transaction : [024423a006e18]#n/
a##217c5d309c6311e29bca000c29c26033#SAPEngine_Application_Thread[impl:
3]_22##0#0#Info#1#com.sap.security.core.util.SecurityAudit#Plain###Guest | USER.CREATE |
USER.PRIVATE_DATASOURCE.un:hacker | | SET_ATTRIBUTE: uniquename=[hacker]#
#1.5#000C29C2603300790000003B000008700004D974E7CD3828#1364996035234#/System/Security/
Audit#sap.com/tc~lm~ctc~util~basic_ear#com.sap.security.core.util.SecurityAudit#Guest#0#SAP
J2EE Engine JTA Transaction : [024423a006e26]#n/
a##217c5d309c6311e29bca000c29c26033#SAPEngine_Application_Thread[impl:
3]_22##0#0#Warning#1#com.sap.security.core.util.SecurityAudit#Plain###Guest |
USERACCOUNT.CREATE | UACC.PRIVATE_DATASOURCE.un:hacker | | SET_ATTRIBUTE:
userid=[USER.PRIVATE_DATASOURCE.un:hacker]#
#1.5#000C29C2603300680002C97A000008700004D974E8354D1D#1364996042062#/System/Security/Audit/
J2EE#sap.com/irj#com.sap.engine.services.security.roles.audit#Guest#182818##n/
a##0c5bfef08bc511e287e6000c29c26033#Thread[Thread-50,5,SAPEngine_Application_Thread[impl:
3]_Group]##0#0#Info#1#com.sap.engine.services.security.roles.audit#Java###{0}: Authorization
check for caller assignment to J2EE security role [{1} : {2}].#3#ACCESS.OK#SAP-J2EE-
Engine#guests#
hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm
34
Invoker
Servlet:
Forensics
(user
crea/on)](https://image.slidesharecdn.com/2013itweb-150623150805-lva1-app6892/85/Breaking-forensicating-and-anti-forensicating-SAP-Portal-and-J2EE-Engine-34-320.jpg)
![• No
traces
of
change
in
default
log
files
clusterserver0logsystemhttpaccessresponses.log
• Webdynpro
sends
all
data
by
POST,
and
we
only
see
GET
URLs
in
responses.log
• But
some8mes
we
can
find
informa8on
by
indirect
signs
[Mar 20, 2013 9:35:49 AM ] - 172.16.0.63 : GET /
webdynpro/resources/sap.com/
tc~lm~webadmin~log_config~wd/Components/
com.sap.tc.log_configurator.LogConfigurator/warning.gif
HTTP/1.1 200 110
• Client
loaded
images
from
server
during
some
changes
41
Advanced
aYacks:
webdynpro
JAVA](https://image.slidesharecdn.com/2013itweb-150623150805-lva1-app6892/85/Breaking-forensicating-and-anti-forensicating-SAP-Portal-and-J2EE-Engine-41-320.jpg)
![Malicious
file
upload:
Forensics
• [Apr 10, 2013 2:26:13 AM ] - 192.168.192.22 :
POST /irj/servlet/prt/portal/prteventname/
HtmlbEvent/prtroot/pcd!3aportal_content!
2fspecialist!2fcontentmanager!2fContentManager!
2fcom.sap.km.ContentManager!
2fcom.sap.km.ContentExplorer!
2fcom.sap.km.ContentDocExplorer!
2fcom.sap.km.DocsExplorer/documents HTTP/1.1
200 13968
• [Apr 10, 2013 2:26:14 AM ] - 192.168.192.22 :
GET /irj/go/km/docs/etc/public/mimes/images/
html.gif HTTP/1.1 200 165
• *Again, images can help us
54](https://image.slidesharecdn.com/2013itweb-150623150805-lva1-app6892/85/Breaking-forensicating-and-anti-forensicating-SAP-Portal-and-J2EE-Engine-54-320.jpg)
Breaking, forensicating and anti-forensicating SAP Portal and J2EE Engine
- 1. Invest in security to secure investments Breaking, forensica/ng and an/-‐forensica/ng SAP Portal and J2EE Engine
- 2. About ERPScan • The only 360-‐degree SAP Security solu8on -‐ ERPScan Security Monitoring Suite for SAP • Leader by the number of acknowledgements from SAP ( 150+ ) • 60+ presenta/ons key security conferences worldwide • 25 Awards and nomina/ons • Research team -‐ 20 experts with experience in different areas of security • Headquarters in Palo Alto (US) and Amsterdam (EU) 2
- 3. Agenda 3 • Why SAP • Why SAP forensics • Why it is hard • AJack examples and forensics – Simple aJacks – Advanced aJacks • Defense • Conclusion
- 4. • The most popular business applica8on • More than 180000 customers worldwide • 74% of Forbes 500 run SAP • 300+ clients in South Africa by 2004 • Almost every South Africa Government runs SAP SAP 4
- 5. • Espionage – TheX of Financial Informa8on – Corporate Secret and informa8on theX – Supplier and Customer list theX – HR data theX • Sabotage – Denial of service – Tampering with financial records – Access to technology network (SCADA) by trust rela8ons • Fraud – False transac8ons – Modifica8on of master data 5 Why SAP Security?
- 6. hJp://erpscan.com/wp-‐content/uploads/2012/06/SAP-‐Security-‐in-‐figures-‐a-‐global-‐survey-‐2007-‐2011-‐final.pdf 0 100 200 300 400 500 600 700 800 900 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 How easy? SAP Security Notes 6
- 7. 0 5 10 15 20 25 30 35 2006 2007 2008 2009 2010 2011 2012 • BlackHat • HITB • Troopers • RSA • Source • ITWeb • DeepSec Point Source: SAP Security in Figures 2013 Is it popular? Talks about SAP security 7
- 8. hJp://erpscan.com/wp-‐content/uploads/2012/06/SAP-‐Security-‐in-‐figures-‐a-‐global-‐survey-‐2007-‐2011-‐final.pdf Is it remotely exploitable? 8
- 9. 9 Is it relevant for South Africa? Simple scan for SAP routers exposed to the Internet: • 63 SAP Routers found in the default port • 27 SAP Routers with medium-‐cri8cal issues • 7 SAP Routers with high-‐cri8cal issues Number of Web-‐based SAP Systems found: • 20 by Shodan
- 10. 0 2 4 6 8 10 12 14 16 SAP Dispatcher SAP MMC SAP Message Server SAP HostControl SAP ITS Agate SAP Message Server httpd World hJp://erpscan.com/wp-‐content/uploads/2012/06/SAP-‐Security-‐in-‐figures-‐a-‐global-‐survey-‐2007-‐2011-‐final.pdf 10 What about other services?
- 11. * This aJack has not been confirmed by the customer nor by the police authori8es in Greece inves8ga8ng the case. SAP does not have any indica8on that it happened. Now, it adds, “We gained full access to the Greek Ministry of Finance. Those funky IBM servers don't look so safe now, do they...” Anonymous claims to have a “sweet 0day SAP exploit”, and the group intends to “sploit the hell out of it.” 11 Who actually tried to break SAP?
- 12. 12 What about unpublished threats? • Companies are not interested in publishing informa8on about their breaches • There are a lot of internal breaches thanks to unnecessarily given authoriza8ons (An employee by mistake buys hundreds of excavators instead of ten) • There are known stories about backdoors leX by developers in custom ABAP code • How can you be sure that, if a breach occurs, you can find evidence?
- 13. hJp://erpscan.com/wp-‐content/uploads/2012/06/SAP-‐Security-‐in-‐figures-‐a-‐global-‐survey-‐2007-‐2011-‐final.pdf 13 SAP Forensics • If there are no aJacks, it doesn’t mean anything • Companies don’t like to share it • Companies don’t use security audit ~10% • Even if used, nobody manages it ~5% • Even if managed, no correla8on ~1%
- 14. 14 Typical SAP audit op/ons • ICM log icm/HTTP/logging_0 70% • Security audit log in ABAP 10% • Table access logging rec/client 4% • Message Server log ms/audit 2% • SAP Gateway access log 2% • % of companies (based on our security assessments and product implementa8ons)
- 15. hJp://erpscan.com/wp-‐content/uploads/2012/06/SAP-‐Security-‐in-‐figures-‐a-‐global-‐survey-‐2007-‐2011-‐final.pdf What do we see? 15 • A lot of research • Real aJacks • Lack of logging prac8ce • Many vulnerabili8es are hard to close → We need to monitor them, at least
- 16. • Ideally, we should control everything, but this talk has limits, so let’s focus on the most critical areas What do we need to monitor? External aYacks on SAP 16 • Awareness AJack users and SAP GUI • Secure configura8on and patch management SAP Router • Disable them Exposed SAP services • Too much issues and custom configura8on • May be 0-‐days • Need to concentrate on this area SAP Portal
- 17. 17 SAP Portal • Point of web access to SAP systems • Point of web access to other corporate systems • Way for aJackers to get access to SAP from the Internet
- 19. 19 Let’s begin the technical part Full logging is not always the best op/on *not only because of system highload
- 20. 20 Full logging is not always the best op/on • SAP MMC – centralized system management • Allowing to see the trace and log messages • If TRACE_LEVEL = 3 → JSESSIONIDs are stored in logs • <SID>DVEBMGS<id>j2eeclusterserver0logsystem userinterface.log • It’s not bad if you only use it some8mes and delete logs aXer use, but…
- 21. 21 But some/mes • SAP MMC has remote commands • By default, many commands go without auth • Commands are simple SOAP requests • AJacker can read logs without auth • And read JSESSIONIDs stored in logs • And use them for logging into SAP Portal
- 22. hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm 22 Preven/on • Don’t use TRACE_LEVEL = 3 • Delete traces when work is finished • Limit access to dangerous methods • Install notes 927637 and 1439348 • Mask security-‐sensi/ve data in HTTP access log
- 23. • The HTTP Provider service can mask security-‐sensi8ve URL parameters, cookies, or headers • By default, only for headers listed below - Path Parameter: jsessionid - Request Parameters: j_password, j_username, j_sap_password, j_sap_again, oldPassword, confirmNewPassword,8cket - HTTP Headers: Authoriza8on, Cookie (JSESSIONID, MYSAPSSO2) hJp://help.sap.com/saphelp_nwce71/helpdata/en/79/77b142c444c96ae10000000a155106/content.htm 23 Masking security-‐sensi/ve data in HTTP log
- 24. SAP AJacks and Forensics * Only J2EE engine 24
- 25. If you are running an ABAP + Java installa9on of Web AS with SAP Web Dispatcher as a load balancing solu9on, you can safely disable logging of HTTP requests and responses on J2EE Engine, and use the corresponding CLF logs of SAP Web Dispatcher. This also improves the HTTP communica9on performance. The only drawback of using the Web Dispatcher’s CLF logs is that no informa4on is available about the user execu4ng the request (since the user is not authen9cated on the Web Dispatcher, but on the J2EE Engine instead). *Not the only…. There are many complex a>acks with POST requests. hJp://help.sap.com/saphelp_nw70ehp1/helpdata/en/ef/8cd7f51dfead42ab90537886104269/frameset.htm 25 SAP Logging
- 26. hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm SAP J2EE Logging 26 • Categories of system events recording: - System – all system related security and administra8ve logs. - Applica8ons – all system events related to business logic. - Performance – reserved for single ac8vity tracing. • Default loca8on of these files in your file system usrsap<sid> <id>j2eecluster<node>log • The developer trace files of the Java instance - <SID><instance name>work • The developer trace files of the central services - <SID><instance name>work - <SID><instance name>log • Java server logs - <SID><instance name>j2eeclusterserver<n>log
- 27. • Informa8on disclosure and XSS • Verb Tampering via HEAD • Invoker servlet via GET All that can be found in HTTP headers. j2eecluster<node>logsystemhttpaccess responses.trc 27 Simple aYacks
- 28. hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm 28 XSS: Forensics #Plain###192.168.192.26 : GET /irj/ servlet/prt/portal/prtroot/ com.sap.portal.usermanagement.admin.Us erMapping?systemid=MS_EXCHANGEaaaa%3C/ script%3E%3Cscript%3Ealert(%27xSS %27)%3C/script%3E HTTP/1.1 200 3968#
- 29. • <servlet> • <servlet-name>CriticalAction</servlet-name> • <servlet-class>com.sap.admin.Critical.Action</ servlet-class> • </servlet> • <servlet-mapping> • <servlet-name>CriticalAction</</servlet-name> • <url-pattern>/admin/critical</url-pattern> • </servlet-mapping • <security-constraint> • <web-resource-collection> • <web-resource-name>Restrictedaccess</web-resource-name> • <url-pattern>/admin/*</url-pattern> • <http-method>GET</http-method> • </web-resource-collection> • <auth-constraint> <role-name>administrator</role-name> </auth-constraint> • </security-constraint> 29 Verb Tampering: Descrip/on (web.xml)
- 30. • Create a new user ITWEB:ITWEB HEAD /ctc/ConfigServlet?param=com.sap.ctc.u8l.UserConfig;CREATEUSER;USERNAME=ITWEB,PASSWORD=ITWEB • Add the user ITWEB to the group Administrators HEAD /ctc/ConfigServlet?param=com.sap.ctc.u8l.UserConfig;ADD_USER_TO_GROUP;USERNAME=ITWEB,GROUPNAME=Administrators Works when UME uses JAVA database 30 Verb Tampering: AYack
- 31. • Install SAP Notes 1503579, 1616259 • Install other SAP Notes about Verb Tampering • Scan applica8ons with ERPScan WEB.XML checker • Disable the applica8ons that are not necessary 31 Verb Tampering: Preven/on
- 32. [Apr 3, 2013 1:23:59 AM ] -‐ 192.168.192.14 : GET /ctc/ConfigServlet HTTP/1.1 401 1790 [Apr 3, 2013 1:30:01 AM ] -‐ 192.168.192.14 : HEAD /ctc/ConfigServlet? param=com.sap.ctc.u8l.UserConfig;CREATEUSER;U SERNAME=ITWEB,PASSWORD=ITWEB HTTP/1.0 200 0 32 Verb Tampering: Forensics
- 33. 33 Invoker Servlet: AYack
- 34. #1.5#000C29C2603300790000003A000008700004D974E7CCC6D8#1364996035203#/System/Security/ Audit#sap.com/tc~lm~ctc~util~basic_ear#com.sap.security.core.util.SecurityAudit#Guest#0#SAP J2EE Engine JTA Transaction : [024423a006e18]#n/ a##217c5d309c6311e29bca000c29c26033#SAPEngine_Application_Thread[impl: 3]_22##0#0#Info#1#com.sap.security.core.util.SecurityAudit#Plain###Guest | USER.CREATE | USER.PRIVATE_DATASOURCE.un:hacker | | SET_ATTRIBUTE: uniquename=[hacker]# #1.5#000C29C2603300790000003B000008700004D974E7CD3828#1364996035234#/System/Security/ Audit#sap.com/tc~lm~ctc~util~basic_ear#com.sap.security.core.util.SecurityAudit#Guest#0#SAP J2EE Engine JTA Transaction : [024423a006e26]#n/ a##217c5d309c6311e29bca000c29c26033#SAPEngine_Application_Thread[impl: 3]_22##0#0#Warning#1#com.sap.security.core.util.SecurityAudit#Plain###Guest | USERACCOUNT.CREATE | UACC.PRIVATE_DATASOURCE.un:hacker | | SET_ATTRIBUTE: userid=[USER.PRIVATE_DATASOURCE.un:hacker]# #1.5#000C29C2603300680002C97A000008700004D974E8354D1D#1364996042062#/System/Security/Audit/ J2EE#sap.com/irj#com.sap.engine.services.security.roles.audit#Guest#182818##n/ a##0c5bfef08bc511e287e6000c29c26033#Thread[Thread-50,5,SAPEngine_Application_Thread[impl: 3]_Group]##0#0#Info#1#com.sap.engine.services.security.roles.audit#Java###{0}: Authorization check for caller assignment to J2EE security role [{1} : {2}].#3#ACCESS.OK#SAP-J2EE- Engine#guests# hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm 34 Invoker Servlet: Forensics (user crea/on)
- 35. hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm 35 Invoker Servlet: Forensics (user crea/on)
- 36. • Update to the latest patch 1467771, 1445998 • “EnableInvokerServletGlobally” must be “false” • Check all WEB.XML files with ERPScan WEBXML checker 36 Invoker servlet: Preven/on
- 37. • Overwrite log file with trash requests • Disable logs (need server restart) • Delete logs (not so easy) * There should be a separate place for logs to prevent modifica4ons and find those types of a>acks 37 An/-‐forensics for simple aYacks
- 38. • CSRF in Webdynpro JAVA • XXE in Portal • Malicious upload in Portal * They all need addi4onal analysis, like enabling POST data logging or indirect signs 38 Advanced aYacks
- 39. • Webdynpro unauthorized modifica8ons • For example: - somebody steals an account using XSS/CSRF/Sniffing - then tries to modify the severity level of logs 39 Advanced aYacks: webdynpro JAVA
- 40. hJp://help.sap.com/saphelp_nw70/helpdata/en/42/fa080514793ee6e10000000a1553f7/frameset.htm 40 Advanced aYacks: webdynpro JAVA
- 41. • No traces of change in default log files clusterserver0logsystemhttpaccessresponses.log • Webdynpro sends all data by POST, and we only see GET URLs in responses.log • But some8mes we can find informa8on by indirect signs [Mar 20, 2013 9:35:49 AM ] - 172.16.0.63 : GET / webdynpro/resources/sap.com/ tc~lm~webadmin~log_config~wd/Components/ com.sap.tc.log_configurator.LogConfigurator/warning.gif HTTP/1.1 200 110 • Client loaded images from server during some changes 41 Advanced aYacks: webdynpro JAVA
- 42. • Most ac8ons have icons • They have to be loaded from the server • Usually, legi8mate users have them all in cache • AJackers usually don’t have them, so they make requests to the server • That’s how we can iden8fy poten8ally malicious ac8ons • But there should be correla8on with a real user’s ac8vity • False posi8ves are possible: - New legi8mate user - Old user clears cache - Other 42 webdynpro JAVA: Forensics
- 43. • Injec8on of malicious requests into XML packets • Can lead to unauthorized file read, DoS, SSRF • There is an XXE vulnerability in SAP Portal • Can be exploited by modifica8on of POST request • It is possible to read any file from OS and much more 43 XXE in Portal: Details
- 44. 44 XXE in Portal: AYack
- 45. 45 XXE in Portal: Details
- 46. 46 XXE in Portal: AYack
- 47. • We can read any file • Including config with passwords • The SAP J2EE Engine stores the database user SAP<SID>DB; its password is here: • usrsap<SID>SYSglobalsecuritydata SecStore.properties 47 XXE in Portal: Result
- 48. • Install SAP note 1619539 • Restrict read access to files SecStore.proper9es and SecStore.key 48 XXE in Portal: Preven/on
- 50. XXE in Portal: Forensics • The only one way to get HTTP POST request values is to enable HTTP Trace. • Visual Administrator → Dispatcher → HTTP Provider → Properties: HttpTrace = enable. - For 6.4 and 7.0 SP 12 and lower: o On Dispatcher /j2ee/cluster/dispatcher/log/ defaultTrace.trc o On Server j2eeclusterserver0logsystemhttpaccessresponses.0.trc - For 7.0 SP13 and higher: /j2ee/cluster/dispatcher/log/services/http/ req_resp.trc • And then you need to manually analyze all requests if there are any XXE attacks. 50
- 51. 51 Malicious file upload: AYack • Knowledge management allows to upload to the server different types of files that can store malicious content • Sometimes, if guest access is allowed, it is possible to upload any file without being an authenticated user • For example, it can be an HTML file with JavaScript that steals cookies
- 52. hJp://help.sap.com/saphelp_nwpi71/helpdata/en/d6/49543b1e49bc1fe10000000a114084/frameset.htm 52 Malicious file upload: AYack
- 53. 53 Malicious file upload: AYack
- 54. Malicious file upload: Forensics • [Apr 10, 2013 2:26:13 AM ] - 192.168.192.22 : POST /irj/servlet/prt/portal/prteventname/ HtmlbEvent/prtroot/pcd!3aportal_content! 2fspecialist!2fcontentmanager!2fContentManager! 2fcom.sap.km.ContentManager! 2fcom.sap.km.ContentExplorer! 2fcom.sap.km.ContentDocExplorer! 2fcom.sap.km.DocsExplorer/documents HTTP/1.1 200 13968 • [Apr 10, 2013 2:26:14 AM ] - 192.168.192.22 : GET /irj/go/km/docs/etc/public/mimes/images/ html.gif HTTP/1.1 200 165 • *Again, images can help us 54
- 55. 55 Malicious file upload: Preven/on • Enable File Extension and Size Filter. - System Administra9on → System Configura9on → Content Management → Repository → Filters → Show Advanced Op9ons → File Extension and Size Filter - you must select either the All repositories parameter, or at least one repository from the repository list in the Repositories parameter. Otherwise, the filter is not created. • Enable Malicious Script Filter. - System Administra9on → System Configura9on → Content Management → Repository → Filters → Show Advanced Op9ons → Malicious Script Filter - the filter also detects executable scripts in files that are being modified and encodes them when they are saved o enable Forbidden Scripts. Comma-‐separated list of banned script tags that will be encoded when the filter is applied. o enable the Send E-‐Mail to Administrator op/on.
- 56. 56 Filtering EPCF in XSS • EPCF provides a JavaScript API for client-‐side communica8on between the Portal components and the Portal core framework • EPCM (Enterprise Portal Client Manager) • iViews can access the EPCM object from every page • Every iView contains the EPCM object • For example, EPCF is used for tranmit user data buffer for iViews • <SCRIPT>alert(EPCM.loadClientData("urn:com.sap.myObjects“,"person");</SCRIPT>
- 57. 57 Advanced aYacks: An/-‐Forensics • If all trace is enabled, it can downgrade speed • It can also occupy all the storage volume • If an aJacker want to spam logs with trash values, he can do it much faster than just with GET logs
- 58. 58 Securing SAP Portal • Patching • Secure configuration • Enabling HTTP Trace with masking • Malicious script filter • Log archiving • Additional place for log storage • Correlation of security events
- 59. And one more thing: • Portal has connec8ons with a lot of systems in corporate LAN • Using SSRF, aJackers can get access to these systems 59 Portal post-‐exploita/on
- 60. HTTP Server Corporate network Direct aJack GET /vuln.jsp SSRF AJack SSRF AJack Get /vuln.jst A B 60 SSRF aYacks
- 61. hJp://erpscan.com/wp-‐content/uploads/2012/08/SSRF-‐vs-‐Businness-‐cri8cal-‐applica8ons-‐whitepaper.pdf 61 Gopher uri scheme Using gopher:// uri scheme, it is possible to send TCP packets • Exploit OS vulnerabili8es • Exploit old SAP applica/on vulnerabili/es • Bypass SAP security restric8ons • Exploit vulnerabili8es in local services More info in our BH2012 presenta8on: SSRF vs. Business Cri9cal Applica9ons
- 62. It is possible to protect yourself from these kinds of issues, and we are working close with SAP to keep customers secure SAP Guides It’s all in your hands Regular security assessments ABAP code review Monitoring technical security Segrega/on of Du/es 62 Conclusion
- 63. Future work • I'd like to thank SAP's Product Security Response Team for the great cooperation to make SAP systems more secure. Research is always ongoing, and we can't share all of it today. If you want to be the first to see new attacks and demos, follow us at @erpscan and attend future presentations: • May 21 – Training at AusCert (Gold Coast, Australia) • June 5-6 – Presentation at RSA (Marina Bay Sands, Singapore) • September 10-12 – BlackHat Trainings (Istanbul, Turkey) 63