November 10, 2015 By Douglas Bonderud 2 min read

The SAP HANA platform has seen marked success over the past few years and counts companies like T-Mobile, Palo Alto Networks and Airbus as customers. But according to CSO Online, there’s a problem: 21 vulnerabilities have now been found by security firm Onapsis, many of them serious. Eight are ranked as critical and several can be remotely exploited, leaving companies open to a data breach or worse. With SAP problems shaking HANA’s tree, how do companies using the product make sure they’re protected?

Big Attack Surface Equals Big Data Breach Risk

Part of the problem with HANA stems from its large attack surface. As noted by ZDNet, more than 10,000 businesses use the platform — both on-premises and in the cloud — to power everything from ERP to CRM to supply chain or business intelligence applications. In February 2015, Onapsis started reporting found flaws to SAP in hopes of prompting a fix. Several patches have since been released, which address some of the problems uncovered.

Others remain unresolved, and Onapsis CEO Mariano Nunez told CSO Online, “The kind of vulnerabilities we discovered would enable any attacker without any user ID or password to remotely have full control of any SAP HANA-based system.” For example, the company found a remote code execution flaw that allowed cybercriminals to control business-relevant information or processes. And according to Dark Reading, attackers plan to demonstrate a way to use SAP ERP as a stepping stone to sabotage oil and gas industry networks at the upcoming Black Hat Europe conference.

Bottom line? Big problems.

Putting Down Roots

How can companies running HANA stay safe? While two of the eight critical vulnerabilities could be addressed with software patches, the other six are hard-coded and require system configuration changes to eliminate.

One such flaw concerns the SAP TCP/IP-based communications protocol TREXNet. Experts recommended that companies ensure all TREXNet exchanges are isolated from end users and employ transport-level authentication. Across the enterprise network at large, meanwhile, it’s a good idea to monitor both HTTP and SQL traffic for any strange activity.

While it’s easy to point the finger at SAP, it has made efforts to make good on the flaws uncovered and — given the scope of its product offering and the size of enterprise networks using the services — it’s no surprise that multiple data breach vulnerabilities exist. Regular patches are one way to stay safe, and companies should make the effort to encrypt TREXNet communication in addition to monitoring network traffic.

There’s also a fail-safe option: Make backups of all critical data and store them apart from HANA-based solutions. That way, even if attackers leverage uncorrected flaws and network monitoring lets malicious code slip through, businesses still have the ability to fall back on stored data.

SAP flaws are shaking HANA’s tree. Put down roots and weather the storm by keeping HANA up to date, monitoring for unusual activity and investing in regular, off-site backups.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today