Chinese most likely using one of top three most common SAP exploits, as identified by Onapsis, to compromise US agencies

The Hill publication reported on November 3, 2014 that Chinese hackers roamed around unnoticed for months inside the network of USIS, is the biggest commercial provider of background investigations to the federal U.S. government.[1] In fact, two of the company’s biggest customers were the Department of Homeland Security (DHS) and the Office of Personnel Management (OPM).

The company performs several thousands of secret background investigations per month; however, this fact became noticed by the public after two renowned cases: the background investigations on Aaron Alexis (Washington Navy Yard shooter) and Edward Snowden (for disclosing top secret materials from the National Security Agency).

On August 6th, 2014, USIS published a press release stating they were hacked by an external entity, and the suspicion that it was a state-sponsored attack (http://www.usis.com/media-release-detail.aspx?dpid=151).

USIS-AP-620x414

Much has been said about this breach, especially the consequence of suspending government contracts with federal agencies (DHS, OPM), causing USIS the loss of millions of dollars and laying off thousands of investigators [1]. Initially, the date and scope of the attack, as well as the exposed information, were not specified. However it was later confirmed that the internal records of at least 25,000 employees of Department of Homeland Security as well as undercover investigators were exposed during this attack, including Social Security numbers, education and criminal history, birth dates along with marital information, other relatives and friends, names and addresses [2].

After the breach, USIS hired the digital forensics company Stroz Friedberg to perform the investigation. On September 2014, a letter from Stroz read: “The initial attack vector was a vulnerability in an application server, housed in a connected, but separate network, managed by a third party not affiliated with USIS.”

Earlier this week, this attack became noticed again when Nextgov [3] published some details about the report produced by the forensics firm on December 2014.

The original report claimed “Forensic evidence shows the cyberattacker gained access to USIS systems through an exploit in a system managed by a third party, and from there migrated to company managed systems. . . . Our findings were largely informed by a variety of logs, including, firewall logs, security event logs, VPN logs, and SAP application trace logs.” USIS spokeswoman, Ellen Davies, also said in the report “the third-party contractor was hacked and the hacker was then able to navigate into the USIS network via the third party’s network.”

According to THE HILL [4], the forensics report points out an SAP vulnerability as the hackers’ door in. Moreover, several sources [1][4][9][10] highlight that this state-sponsored attack is related to Chinese hackers. On March 2014, hackers who have penetrated computers at the Office of Personnel Management were traced to China; that attack was targeted to the files of tens of thousands of employees who have applied for top-secret security clearances [5]. This time, investigators are saying the USIS attack has several hallmarks to past Chinese intrusions like the one at OPM [1].

This breach illustrates a reality that often is not reported in mainstream news: the impact of cyber-attacks on SAP Systems to retrieve critical and confidential information. Attackers were able to access the USIS network in late 2013 but weren’t discovered until June 2014[6]. This means that the attackers had at least 6 months of access to internal and sensitive information without being noticed. The damage is difficult to estimate and shows the current lack of awareness around how SAP systems must be protected and monitored.

The report states that the vulnerability is “present in a widely used and highly-regarded enterprise resource planning (‘ERP’) software package”, however, there aren’t any details about the specific vulnerability or set of vulnerabilities that were used to compromise the SAP System.

Since the attack originated in late 2013, it is important to analyze the known vulnerabilities that were patched by SAP at that time, as well as the vulnerabilities patched after that date, which indicates the possibility of using 0-day exploits. Since the details are unknown, there is no way to specify whether the attackers used an exploit that was still not still patched by SAP, or if it was USIS who didn’t patch a well-known vulnerability.

According to the articles and research, USIS attackers exploited this SAP vulnerability externally in order to access the company network. Once inside the network they used it to pivot to other systems. Onapsis also recently released a study on top 3 SAP Cyber Attacks with one focused on “pivoting” [11][12][13][14], . This is a common approach used by attacker’s to gain access to employee data, customer information or even credit card data “Pivoting” Between SAP Systems. The attack begins with a pivot from a system with lower security such as a development or QA system, to a critical system in order to execute remote function module in the destination system. SAP systems are connected to the Internet and a single weak link is required for the attackers to start pivoting between systems and to then begin moving through the internal network. This appears to be the behavior described for the USIS hackers.

SAP systems have always been a target for hackers as they run the most critical and sensitive processes for the largest companies and government agencies in the world. Examples such as the USIS breach are showing the importance of protecting our SAP Systems and eradicates the false idea of business critical applications being “internal and isolated” as we often hear from SAP administrators. SAP itself has acknowledged the criticality of this topic, while presenting at its own conference, SAP TechEd 2014 as well as presenting cyber-crime related talks at SAP SAPPHIRE 2015, “SAP Runs SAP – How to Hack 95% of all SAP ABAP Systems and How to Protect them”.

It seems that hackers are knocking on the doors of our business-critical applications. As these kind of attacks are increasing, companies should move towards to the next steps in business critical applications security.

Onapsis Research Labs, experts since 2006 has been tracking other examples in the wild of this common attack vector and will be publishing a report at a later date. In the meantime, attackers are moving faster and companies and governments need to be prepared; automated, continuous monitoring and real-time security measures are the next step to solve and mitigate these ever evolving threats.

To discuss this issue in greater detail, Onapsis will be hosting a webcast on Thursday May 21st at both 9:00 A.M. EST and 2:00 P.M. EST. For more information, or to register please click here.

References:

[1]: http://thehill.com/policy/cybersecurity/222677-report-chinese-hacked-security-contractor

[2]: http://www.reuters.com/article/2014/08/22/us-usa-security-contractor-cyberattack-idUSKBN0GM1TZ20140822

[3]: http://www.nextgov.com/cybersecurity/2015/05/third-party-software-was-entry-point-background-check-system-hack/112354/

[4]: http://thehill.com/policy/cybersecurity/241588-report-hackers-infiltrated-security-contractor-using-third-party

[5]: http://www.nytimes.com/2014/07/10/world/asia/chinese-hackers-pursue-key-data-on-us-workers.html

[6]: http://bigstory.ap.org/article/427fbd5d88f5481eab35f5a8bbc534be/security-contractor-breach-not-detected-months

[7]: http://www.hsgac.senate.gov/media/majority-media/chairman-carper-statement-on-reported-usis-cyber-breach

[8]: http://www.onapsis.com/onapsis-research-study-reveals-top-three-cyber-attack-vectors-sap-systems

[9]: http://www.theblaze.com/stories/2014/11/04/cyberattack-on-top-u-s-govt-security-contractor-went-unnoticed-for-months/

[10]: http://www.foxnews.com/tech/2014/11/04/hacker-attack-on-federal-security-contractor-not-noticed-for-months-report/

[11]: Onapsis SSID – Volume IV: The Invoker Servlet – A Dangerous Detour into SAP Java Solutions

[12]: Onapsis SSID – Volume V: Our Crown Jewels Online – Attacks targeting SAP Web Applications

[13]: Onapsis SSID – Volume VI: Securing the Gates to the Kingdom – Auditing the SAProuter

[14]: Onapsis SSID – Volume VII: Preventing Cyber-attacks Against SAP Solution Manager

 

Share Button

Analyzing SAP Security Notes April 2015 Edition

SAP is a complex and ever changing system, whether because of changes introduced to your SAP implementation to better suit your business, or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at least.

At Onapsis we are very concerned about our client’s SAP system security and also the state of SAP security in general. To assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems and help guide their testing of these systems within their organization.

Between the last published SAP Security Tuesday and today, there were 15 SAP Security notes published by SAP AG (taking into account 6 Support Packages and 9 Patch Day Notes). There were just three external security researchers mentioned this month. Two of them, Nahuel Sánchez and Fernando Russ, are from the Onapsis Research Labs. Together, they work with the rest of the Research team and SAP AG to help make SAP software more secure.

The plot graph illustrates the distribution of CVSS scores across the released Security Notes. The only notes taken into account were the ones to which SAP set a CVSS (5 out of the 15 SAP Security Notes). As it’s represented in the graph, the SAP Security Notes range values go from 3.6 to 5.8 with a median of 4.3.

Continue reading

Share Button

The Evolving SAP Cyber-Security Landscape

Stephen Higgins, Senior Vice President of Customer Experience, Services and Solutions at Onapsis

$1.3 billion lost an hour!  This is what one of our global customer’s estimates is the impact to their business if their SAP systems become compromised and operations are disrupted.  The cost of an SAP breach can be inconceivable. And yet, it may be one of the most under scrutinized areas in IT security from a business continuity perspective.  Everyday our services team sees the real-world impact of breaches to organization’s SAP systems. This in mind, our consensus is that it is imperative to not only be able to detect a potential attack, but to have a response plan in place in case an attack still occurs. Responding quickly is where many organizations reach out to Onapsis for expert advice.

What we see is that there is a tendency amongst organizations to think that once a year is enough to perform a security assessment of SAP systems. More often than not, it’s assumed that Segregation of Duties and/or basic perimeter defenses are enough to protect systems from intrusion, and that penetration tests are only a necessary evil – for when internal auditors are requesting an update. However, with the “Bad Guys” getting more intelligent about business-critical systems, their ability to exploit these systems is becoming more and more advanced.

If you’ve taken a look at major headlines recently, you’ve likely noticed the staggering number of corporations who’ve suffered large-scale data breaches. Many of these breaches were targeted at SAP and other business-critical applications.  The impact of these breaches could have been minimized and potentially avoided had there been proper security measures in place for continuously monitoring their business-critical applications. As attacks of this nature will continue to evolve in complexity, it is absolutely imperative to have a preventative, systematic approach to SAP security in place in order to help your organization avoid interruptions to its business and incur huge financial liabilities.

Continue reading

Share Button

Analyzing SAP Security Notes March 2015 Edition

SAP is a complex and ever changing system, whether because of changes introduced to your SAP implementation to better suit your business, or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at minimum.

At Onapsis we are very concerned about our client’s SAP system security and also the state of SAP security in general. To assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems and help guide their testing of these systems within their organization.

Since the last SAP Security Tuesday and today, there were 21 SAP Security notes published by SAP (taking into account 3 Support Packages and 18 Patch Day Notes). There were notes published by external security researchers from which, Onapsis Research Labs reported SAP Security Note 2122391 (by Sergio Abraham).

The plot graph illustrates the distribution of CVSS scores across released Security Notes. The only notes taken into account were the ones to which SAP set a CVSS (16 out of the 21 SAP Security Notes). As represented in the graph, the SAP Security Notes value ranges from 3.5 to 6.8 with a median of 5.0. Continue reading

Share Button

Analyzing SAP Security Notes February 2015 Edition

SAP is a complex and ever changing system, whether because of changes introduced to SAP implementation to better suit the business, or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at the very least.

At Onapsis, we are very concerned about our client’s SAP system security and the state of SAP security in general. To assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems, and to help guide their testing of these systems within their organization.

On this Patch Day (second Tuesday of each month) SAP published 16 Security Notes (taking into account 2 Support Packages and 14 Patch Day Notes). There were notes published by external security researchers from which, Onapsis Research Labs reported SAP Security Note 2109818 discovered by security researchers Nahuel D. Sánchez and Fernando Russ.

The plot graph illustrates the distribution of CVSS scores across the Security Notes released. The only notes taken into account were the ones for which SAP set a CVSS (12 out of the 16 SAP Security Notes). As it’s represented in the graph, the SAP Security Notes range values go from 3.5 to 7.5 with a median of 5.25.

Continue reading

Share Button

Analyzing SAP Security Notes January 2015 Edition

NEW NOTE (January 21, 2015): Note 2120370 has been released after the official SAP post of January 12nd. The note extends the security note 2001109, covering further affected releases (BI 4.1 SP04 & BI 3.1 Patch 6.5).
UPDATE (January 19, 2015): Note 1951171 has been rereleased translated into English, since it was originally published in German.
NEW NOTE (January 14, 2015): Note 1964201 has been released after the official SAP post of January 12nd. The note fixes a directory traversal in INTRASTAT module.

SAP is a complex and ever changing system, whether because of changes introduced to SAP implementation to better suit the business, or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at the very least.

At Onapsis we are very concerned about our client’s SAP system security and the state of SAP security in general. To assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems, and to help guide their testing of these systems within their organization.

Box-Plot image - January 2015Between the last SAP Security Tuesday and the notes published in January, there were 19 SAP Security notes (taking into account 7 Support Packages and 12 Patch Day Notes). There were notes published by external security researchers from which, Onapsis Research Labs reported SAP Security Note 2109565 by researchers Sergio Abraham, Nahuel D. Sánchez and Fernando Russ.

The plot graph illustrates the distribution of CVSS scores across the Security Notes released. The only notes taken into account were the ones for which SAP set a CVSS (6 out of the 19 SAP Security Notes). As it’s represented in the graph, the SAP Security Notes range values go from 4.9 to 8.5 with a median of 6.0.

Continue reading

Share Button

Analyzing SAP Security Notes December 2014 Edition

High-profile risk threats identified by Onapsis Research Labs experts reveals that unauthorized users could access business-critical applications leveraging SAP BusinessObjects

SAP is a complex and ever changing system, whether because of changes introduced to your SAP implementation to better suit your business or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at least.

At Onapsis we are very concerned about our client’s SAP system security and also the state of SAP security in general, so to assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems and help guide their testing of these systems within their organization.

Between the last published SAP Security Tuesday and today, there were 28 SAP Security notes published by SAP (taking into account 3 Support Packages and 25 Patch Day Notes).

The plot graph illustrates the distribution of CVSS scores across the Security Notes released in December. The only notes taken into account to build it, were the ones to which SAP set a CVSS (14 out of the 28 SAP Security Notes). As you may observe in the graph, the SAP Security Notes this month have a range of values from 1.5 to 7.5 with a median of 3.9.

Continue reading

Share Button

Analyzing SAP Security Notes November 2014 Edition

SAP is a complex and ever changing system, whether because of changes introduced to your SAP implementation to better suit your business or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at least.

At Onapsis we are very concerned about our client’s SAP system security and also the state of SAP security in general, so to assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems and help guide their testing of these systems within their organization.

box-plot-November-2014This month, SAP published an unusually quantity of SAP Security Notes: 86 Security Notes (taking into account 65 Support Packages and 21 Patch Day Notes). It was mostly due to a new feature which enhance the security management of RFC Functions and fixes to missing authority check vulnerabilities.

The plot graph illustrates the distribution of CVSS scores across the Security Notes released in November. The only notes taken into account to make it, where the ones to which SAP set a CVSS (14 out of the 86 SAP Security Notes). As you may observe in the graph, the SAP Security Notes this month have a range of values from 3.5 to 10.0 with a median of 6.

Continue reading

Share Button

Analyzing SAP Security Notes October 2014 Edition

UPDATE (November 4, 2014): Note 2043404 has been rereleased with an updated priority. The priority was increased from medium to very high. The new CVSS for this Note is 9.3 (AV:N/AC:M/AU:N/C:C/I:C/A:C)

SAP is a complex and ever-changing system. Between changes introduced to SAP implementation to improve your business, and the application of Security Notes (Patches) to ensure mitigation of newly disclosed vulnerabilities, SAP is constantly evolving.

In order to provide a scheduled flow of vulnerability mitigation information and security patches, SAP releases the majority of new Security Notes on the second Tuesday of each month. Due to this regular disclosure of security alerts warning against potentially harmful issues, it is highly recommended to carry out periodic assessments on a monthly basis (at minimum) to ensure that existing security on your SAP systems does not become weakened.

At Onapsis, we’re very concerned about our client’s SAP system security, as well as the state of SAP security in general. In order to best assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with comprehensive information about the newly released notes and vulnerabilities affecting SAP systems, and to help guide testing of these systems within their organization.

This month 34 SAP Security Notes were published by SAP (taking into account 11 Support Packages and 23 Patch Day Notes). Additionally, there were changes on how SAP communicates vulnerabilities reported by external security researchers, as it previously wasn’t clear which were externally reported.

Five of the vulnerabilities fixed this month were discovered by members of the Onapsis Research Labs:

Here you have a plot graph illustrating the distribution of CVSS scores of the Security Notes released in October. The only notes taken into account where the ones for which SAP set a CVSS (19 out of the 34 SAP Security Notes). As you may observe in the graph, the SAP Security Notes this month have a range of values from 4.3 to 7.5 with a median of 6.4. Continue reading

Share Button

Analyzing SAP Security Notes September 2014 Edition

SAP is a complex and ever changing system, whether because of changes introduced to your SAP implementation to better suit your business or through the application of Security Notes (Patches) to ensure that newly disclosed vulnerabilities are mitigated.

In order to provide a predictable and scheduled flow of vulnerability mitigation information and security patches, SAP releases the major part of their latest Security Notes information on the second Tuesday of every month. Due to this regular disclosure of new security issues that could potentially weaken the security of SAP systems within an organization, it’s highly recommended to carry out periodic assessments on a monthly basis at least.

At Onapsis we are very concerned about our client’s SAP system security and also the state of SAP security in general, so to assist our customers, we perform a detailed analysis of the monthly SAP Security Notes as soon as they are published. The goal of this is to provide SAP clients with detailed information about the newly released notes and vulnerabilities affecting their SAP systems and help guide their testing of these systems within their organization.

This month, 29 SAP Security Notes were published by SAP (taking into account 3 Support Packages and 26 Patch Day Notes). There were ten notes reported by external researchers, of the ten Onapsis Research Labs reported two of them.

  • 2039905 by Juan Pablo Perez Etchegoyen and Will Vandevanter
  • 1979454 by Pablo Muller

Here you have a plot graph illustrating the distribution of CVSS scores across the Security Notes released in September. The only notes taken into account were the ones for which SAP calculated a CVSS score (19 out of the 29 SAP Security Notes). As you may observe in the graph, the SAP Security Notes this month had a range of values from 2.1 to 6.5 with a median of 5.0.

Continue reading

Share Button