Securing SAP Mobile Platforms: Beyond the Device

Mobile security is definitely a hot topic in our industry. However, it’s quite hard to find people talking about mobile security beyond managing/securing the device itself. Most industry solutions are focused in deploying a secure BYOD strategy and ensuring the devices cannot be exploited with malware.

While this approach is highly important, I have found it difficult to find solutions that actually look at the security of the backend servers that are used by such mobile devices. These servers vary from simple Apache, IIS or Tomcat application servers with Web mobile apps to highly proprietary components.

If your company is using SAP mobile applications in you employees’ tablets or smartphones, then you have SAP servers exposed to the Internet to serve such devices, which already puts them in a more risky situation (Internal threats mentioned on previous blog). With 6000+ customers already using them and being one of the fastest growing product line for SAP AG, it’s highly likely that you are or soon will be empowering your users with SAP-branded apps.

In this scenario, an attacker only needs to perform an external scan to discover such components, and – be sure about it – he is not limited to the functionality that the SAP mobile app is providing your users. He can interface with such SAP servers with a variety of attack tools and try to exploit vulnerabilities in them. The result? He may be able to compromise your entire SAP infrastructure, remotely over the Internet.

This was a growing concern in many of our leading customers, and I’m glad to announce that we responded quickly: Onapsis X1 is now the first-and-only product in the market equipped to detect & assess vulnerabilities affecting SAP Mobile Platforms (Sybase Unwired Platforms), SAP NetWeaver Gateway and SAP Fiori apps.

We are going to be showcasing this new version at booth #231 during the Black Hat Conference this month in Las Vegas as well as hosting a 2 day SAP Security In-Depth training.

Remember that your mobile apps are probably connecting to a backend system in your network. If it’s SAP, we got you covered.

 

Share Button

External vs Insider Threats: Why there are no “internal” SAP systems

I would like to reflect on a common situation that I have repeatedly heard over the past few years when talking and training on the topic of SAP security:

When I ask the question:

  • “How are you dealing with the cyber-threats affecting your SAP platform?”

Most commonly I get the answer:

  • “Oh, our SAP system is internal, so we are fine.”

I humbly believe that many people have a misconception about this statement, and it is about time that we clarify that the old paradigm of “external vs. internal” has not applied in information security for a long time. It doesn’t apply when we talk about networks, and therefore, it does not apply when we talk about threats. And specifically, it does not apply to SAP environments.

Let’s analyze why:

  1. Who’s on your “local” network? Several decades ago your local network would only be hosting very few and trustworthy employees. Today, the local network must be considered as harmful as any other untrusted network. Surprisingly, many large organizations still have the SAP platform deployed in networks which are directly reachable from the end-user network (no internal DMZ), significantly increasing the attack surface.

Furthermore, because most large organizations are outsourcing the management of their SAP platforms to 3rd party contractors, less controls can be enforced. Just in the last training we held at Black Hat USA, three students commented privately that they had suffered a breach in their SAP systems, having a disgruntled outsourced contractor as the perpetrator.  

  1. That one application. It’s not rare to hear from Information Security peers that they were not aware (most of the time, were not informed) of that one application that actually exposes SAP components to suppliers, partners or customers. Because of modern business requirements, many SAP systems are effectively used to provide online access to business processes, usually through Web applications (could be running on top of SAP itself) or Mobile platforms.
  1. Your internal users have email access. Even if there is no SAP Web application to exploit directly, malicious attackers would of course not give up. For several years now, they would just use client-side exploits in spear phishing attacks: sending malware through a malicious PDF or MS Office document to any internal employee. Upon opening it, your internal user would surrender the entire “local” network to an attacker who may be sitting thousands of miles away. From there, the attacker has effectively established a presence inside your network and can just fire at will at the SAP systems (back to point 1!).
  1. Your SAP system is online. I’m sorry for the bad news, but don’t kill the messenger. SAP AG provides support services (such as EarlyWatch) remotely from specific locations. In order for them to do so, you need to deploy a component called SAProuter that will proxy the remote support connections to your “internal” SAP systems.

Ideally, it should be set up through a VPN connection with SAP AG only, but more often than not it’s possible to find them directly exposed to the Internet. An unsecured SAProuter could be completely exposing your SAP platform to the world. Read this SAP Security In-Depth publication for more information regarding the SAProuter.

In order to mitigate the risks that affect our SAP platform, we first need to understand the threats we are facing. We need to accept that our SAP systems are in fact connected to rouge and untrusted networks. With that mindset change, we can then analyze how to holistically protect it from cyber-attacks.

 

 

Share Button

The Onapsis ERP Security Blog

Welcome to the Onapsis ERP Security Blog!

While leading organizations are already taking measures to protect their ERP systems from the increased threat of cyber-attacks, at Onapsis we feel that “leading” is not enough. We realize that still a significant number of organizations are not able to answer a very important question: “Is my ERP implementation secure?” At Onapsis, we know this uncertainty only empowers the bad guys and we feel it’s our duty to level the battlefield. That’s why we created this Blog.

Traditional measures like Segregation of Duties controls are one necessary step, but no longer enough to protect against advanced ERP application-layer attacks. Through this channel, our thought-leaders will share their best-practices, knowledge, war stories and latest research to help you better understand the risks that your company faces as these systems continue to become an increasing target to cyber-attacks. More importantly, we will provide you with actionable guidelines for you to increase the security of your ERP platform – effectively safeguarding your business crown jewels.

Stay tuned for the upcoming posts. We sincerely hope you enjoy them!

The Onapsis Team

Share Button