Cybersecurity providers Digital Shadows and Onapsis released a report on July 25 that outlined additional evidence of threat actors targeting enterprise resource planning (ERP) applications, particularly SAP applications, according to Reuters.

Back in May 2016, SAP customers awoke to the news of a U.S. Computer Emergency Readiness Team (US-CERT) advisory to address the security of their SAP applications, especially internet-facing ones, due to evidence of unauthorized exploitation of a critical vulnerability previously patched by SAP more than five years before.

In some cases, these attackers are still exploiting the same vulnerability that was highlighted back in 2016.

Attackers Trade CVEs Affecting ERP Applications on the Darknet

The Digital Shadows and Onapsis report detailed the increase in the threats associated with the Common Vulnerabilities and Exposures (CVE) affecting ERP applications and exploits that could be used to abuse those vulnerabilities.

Additionally, these threats are getting more attention from malicious actors, as evidenced by a significant increase in the references to SAP and Oracle CVEs on the darknet, including criminal and underground forums that contain posts detailing how to hack an SAP application and requests for exploits of SAP HANA.

Per the Digital Shadows and Onapsis report, 50 exploits for SAP products and 30 for the Oracle EBS technology stack were found in one darknet forum alone when Digital Shadows combed through social media chatter.

Eight Key Findings From the Digital Shadows and Onapsis Report

The report serves as a wake-up call for organizations that are not adequately addressing cybersecurity for their SAP applications.

Here are eight key findings:

1. The risks are growing year over year. New CVEs, vulnerabilities in exploits increase the attack surface, especially for organizations that are falling behind on security patches.
2. The interest from cyberattackers in vulnerabilities affecting SAP applications is growing considerably year over year — more specifically 130 percent from 2016 to 2017.
3. Nine operations from hacktivist groups have been discovered with claims of sabotaging operations and compromising business-critical applications.
4. A well-known malware, Dridex, was found to be updated in 2017 and as recently as February 2018 to target the most widely used SAP client software, enabling cybercriminals to steal valid SAP user credentials.
5. Over 500 configuration files were discovered on insecure file repositories over the internet, along with employees sharing ERP login credentials in public forums.
6. Threat actors are incorporating SAP applications as part of the scope of their campaigns, as shown in over 20 examples throughout the report.
7. Some 17,000 SAP and Oracle software installations are exposed to the internet at more than 3,000 top companies, government agencies and universities.
8. More than 4,000 known bugs in SAP and 5,000 in Oracle software pose security threats, especially in older systems that have not been patched or upgraded.

Password Hygiene and Patch Management Are Crucial to Protect ERP Apps

Attackers are not only targeting externally facing SAP applications, but also internal systems, using version 4 of the Dridex malware. This is one of the 20 examples shared in the report. Newer versions of ERP applications are also being targeted — the report cited examples of a post where a user is requesting any known SAP HANA vulnerability.

In addition, “sap123,” a default password, is shown to have been used in a compromised remote desktop protocol (RDP) session. RDP is a proprietary protocol that provides users with a graphical interface to connect to another computer over a network connection. Companies need to ensure that employees are properly trained in good password hygiene, according to Michael Melore, cybersecurity advisor at IBM Security.

Attackers are often drawn to mission-critical ERP systems due to the sensitive and confidential data they hold. After Oracle released a patch for CVE-2017-10271, a vulnerability in WebLogic, which is often used as a server for Peoplesoft, an exploit for this vulnerability was subsequently made available two months later, per the data collected by Digital Shadows.

Sources: Reuters, Onapsis, US-CERT