July 26, 2018 By Security Intelligence Staff 3 min read

Cybersecurity providers Digital Shadows and Onapsis released a report on July 25 that outlined additional evidence of threat actors targeting enterprise resource planning (ERP) applications, particularly SAP applications, according to Reuters.

Back in May 2016, SAP customers awoke to the news of a U.S. Computer Emergency Readiness Team (US-CERT) advisory to address the security of their SAP applications, especially internet-facing ones, due to evidence of unauthorized exploitation of a critical vulnerability previously patched by SAP more than five years before.

In some cases, these attackers are still exploiting the same vulnerability that was highlighted back in 2016.

Attackers Trade CVEs Affecting ERP Applications on the Darknet

The Digital Shadows and Onapsis report detailed the increase in the threats associated with the Common Vulnerabilities and Exposures (CVE) affecting ERP applications and exploits that could be used to abuse those vulnerabilities.

Additionally, these threats are getting more attention from malicious actors, as evidenced by a significant increase in the references to SAP and Oracle CVEs on the darknet, including criminal and underground forums that contain posts detailing how to hack an SAP application and requests for exploits of SAP HANA.

Per the Digital Shadows and Onapsis report, 50 exploits for SAP products and 30 for the Oracle EBS technology stack were found in one darknet forum alone when Digital Shadows combed through social media chatter.

Eight Key Findings From the Digital Shadows and Onapsis Report

The report serves as a wake-up call for organizations that are not adequately addressing cybersecurity for their SAP applications.

Here are eight key findings:

  1. The risks are growing year over year. New CVEs, vulnerabilities in exploits increase the attack surface, especially for organizations that are falling behind on security patches.
  2. The interest from cyberattackers in vulnerabilities affecting SAP applications is growing considerably year over year — more specifically 130 percent from 2016 to 2017.
  3. Nine operations from hacktivist groups have been discovered with claims of sabotaging operations and compromising business-critical applications.
  4. A well-known malware, Dridex, was found to be updated in 2017 and as recently as February 2018 to target the most widely used SAP client software, enabling cybercriminals to steal valid SAP user credentials.
  5. Over 500 configuration files were discovered on insecure file repositories over the internet, along with employees sharing ERP login credentials in public forums.
  6. Threat actors are incorporating SAP applications as part of the scope of their campaigns, as shown in over 20 examples throughout the report.
  7. Some 17,000 SAP and Oracle software installations are exposed to the internet at more than 3,000 top companies, government agencies and universities.
  8. More than 4,000 known bugs in SAP and 5,000 in Oracle software pose security threats, especially in older systems that have not been patched or upgraded.

Password Hygiene and Patch Management Are Crucial to Protect ERP Apps

Attackers are not only targeting externally facing SAP applications, but also internal systems, using version 4 of the Dridex malware. This is one of the 20 examples shared in the report. Newer versions of ERP applications are also being targeted — the report cited examples of a post where a user is requesting any known SAP HANA vulnerability.

In addition, “sap123,” a default password, is shown to have been used in a compromised remote desktop protocol (RDP) session. RDP is a proprietary protocol that provides users with a graphical interface to connect to another computer over a network connection. Companies need to ensure that employees are properly trained in good password hygiene, according to Michael Melore, cybersecurity advisor at IBM Security.

Attackers are often drawn to mission-critical ERP systems due to the sensitive and confidential data they hold. After Oracle released a patch for CVE-2017-10271, a vulnerability in WebLogic, which is often used as a server for Peoplesoft, an exploit for this vulnerability was subsequently made available two months later, per the data collected by Digital Shadows.

Sources: Reuters, Onapsis, US-CERT

More from

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today