Sap security – thinking with a hacker’s hat

Presented by Anand Tanksali – CISSP, CEH

SAP – (Systems Application and Products)
Provides different solutions:
CRM, ERP, PLM, SCM, GRC, Business One…
ERP Solutions consist of :
FI,CO (Finance and Controlling)
SD (Sales Distribution)
HR (Human Resources)
MM (Materials Management) etc…
Modules integrated together using Netweaver platform
SAP runs on multiple Operating Systems

Instances & Systems
Admin entity groups related components providing one or more services
Systems are identified by SAP System ID (SID)
System instances parameterization done in Profiles
Client  Transaction  Authorization
Client default (000, 001 and 006)
Transaction code (SU01, SE16, FK01, PA20)
Authorizations  Users assigned roles as per profiles and contains authorizations
ABAP, Reports/Programs, Function Modules, RFC

SAP_ALL profile = SAP GOD
Many profiles may enable and allow user to be GOD
Each SAP system uses its own DB
SAP processes run under <sid>adm or SAPService <SID> user accounts
Direct access to DB means SAP compromised!!!!
Connections between systems always based on TRUST
Many customer interfaces implemented using FTP (cleartext, weak passwords)

Why do you need SAP Security?
Errr What about Security I don’t care SAP should be up and running by Tuesday we have to take care of user passwords Umm What Security we have enough guards no more excuses SAP should be up on Tuesday

What the CFO does not realize : Weak security controls can result in Business and Financial Loss / Frauds
CSO does not realize: SAP Security is much more than User Roles, Responsibilities & Authorizations

Security configurations of SAP is usually left to default
By default many configurations are not secure
Conclusion – SAP systems are not secure

First SAP Penetration Testing Framework developed by Cybsec -Labs
Provides support for
platform discovery
investigation and
exploitation
Current versions available on Windows / Linux

SAP designed to interact with external systems
Integrated Centralized information
Communicating with other systems
ALE
EDI
HTTP
RFC
FTP
XML ……

In early years SAP implemented IBM CPI-C interface to communicate with other systems
CPI-C allowed data transfer
Complex apps needed to call functions on other servers resulting in SAP Remote function Call interface
RFC is the key component of SAP apps

Vulnerabilities published by SAP

Admin should change passwords at regular intervals
Ensure user should not have SAP_ALL access rights
Adhere to SAP best practices
Disable auto unlocking
Enforce a strong password policy
Restrict access to Database

RFC is the weakest link in SAP and needs to be secured
SAP admin must apply patches and harden the servers
Network admin should apply rules on firewall and deny ports not required to be used for day-to-day operations
Network admin should monitor logs regularly
Advanced attacks should be avoided with proper configurations and patch management

Thank You! Anand Tanksali Email: daemonology@gmail.com

Sap security – thinking with a hacker’s hat

by n|u - The Open Security Community on Jan 07, 2012

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 392

Statistics

Sap security – thinking with a hacker’s hat — Presentation Transcript