July 26, 2018 By Security Intelligence Staff 3 min read

Cybersecurity providers Digital Shadows and Onapsis released a report on July 25 that outlined additional evidence of threat actors targeting enterprise resource planning (ERP) applications, particularly SAP applications, according to Reuters.

Back in May 2016, SAP customers awoke to the news of a U.S. Computer Emergency Readiness Team (US-CERT) advisory to address the security of their SAP applications, especially internet-facing ones, due to evidence of unauthorized exploitation of a critical vulnerability previously patched by SAP more than five years before.

In some cases, these attackers are still exploiting the same vulnerability that was highlighted back in 2016.

Attackers Trade CVEs Affecting ERP Applications on the Darknet

The Digital Shadows and Onapsis report detailed the increase in the threats associated with the Common Vulnerabilities and Exposures (CVE) affecting ERP applications and exploits that could be used to abuse those vulnerabilities.

Additionally, these threats are getting more attention from malicious actors, as evidenced by a significant increase in the references to SAP and Oracle CVEs on the darknet, including criminal and underground forums that contain posts detailing how to hack an SAP application and requests for exploits of SAP HANA.

Per the Digital Shadows and Onapsis report, 50 exploits for SAP products and 30 for the Oracle EBS technology stack were found in one darknet forum alone when Digital Shadows combed through social media chatter.

Eight Key Findings From the Digital Shadows and Onapsis Report

The report serves as a wake-up call for organizations that are not adequately addressing cybersecurity for their SAP applications.

Here are eight key findings:

  1. The risks are growing year over year. New CVEs, vulnerabilities in exploits increase the attack surface, especially for organizations that are falling behind on security patches.
  2. The interest from cyberattackers in vulnerabilities affecting SAP applications is growing considerably year over year — more specifically 130 percent from 2016 to 2017.
  3. Nine operations from hacktivist groups have been discovered with claims of sabotaging operations and compromising business-critical applications.
  4. A well-known malware, Dridex, was found to be updated in 2017 and as recently as February 2018 to target the most widely used SAP client software, enabling cybercriminals to steal valid SAP user credentials.
  5. Over 500 configuration files were discovered on insecure file repositories over the internet, along with employees sharing ERP login credentials in public forums.
  6. Threat actors are incorporating SAP applications as part of the scope of their campaigns, as shown in over 20 examples throughout the report.
  7. Some 17,000 SAP and Oracle software installations are exposed to the internet at more than 3,000 top companies, government agencies and universities.
  8. More than 4,000 known bugs in SAP and 5,000 in Oracle software pose security threats, especially in older systems that have not been patched or upgraded.

Password Hygiene and Patch Management Are Crucial to Protect ERP Apps

Attackers are not only targeting externally facing SAP applications, but also internal systems, using version 4 of the Dridex malware. This is one of the 20 examples shared in the report. Newer versions of ERP applications are also being targeted — the report cited examples of a post where a user is requesting any known SAP HANA vulnerability.

In addition, “sap123,” a default password, is shown to have been used in a compromised remote desktop protocol (RDP) session. RDP is a proprietary protocol that provides users with a graphical interface to connect to another computer over a network connection. Companies need to ensure that employees are properly trained in good password hygiene, according to Michael Melore, cybersecurity advisor at IBM Security.

Attackers are often drawn to mission-critical ERP systems due to the sensitive and confidential data they hold. After Oracle released a patch for CVE-2017-10271, a vulnerability in WebLogic, which is often used as a server for Peoplesoft, an exploit for this vulnerability was subsequently made available two months later, per the data collected by Digital Shadows.

Sources: Reuters, Onapsis, US-CERT

More from

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Pentesting vs. Pentesting as a Service: Which is better?

5 min read - In today's quickly evolving cybersecurity landscape, organizations constantly seek the most effective ways to secure their digital assets. Penetration testing (pentesting) has emerged as a leading solution for identifying potential system vulnerabilities while closing security gaps that can lead to an attack. At the same time, a newer entrant into the security arena is Pentesting as a Service (PTaaS). Although PTaaS shares some similarities with pentesting, distinct differences make them two separate solutions. This article will discuss how these methodologies…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today