Welcome BIZEC Roundtable @ IT Defense, Berlin SAP Security BIZEC APP/11 Version 2.0 BIZEC TEC/11 Version 2.0 February 1, 2013 Andreas Wiegenstein CTO, Virtual Forge
2 SAP Security SAP security is a complex discipline. It must be addressed holistically: SoD controls (user roles and profiles) are necessary, but they are not enough. As covered by BIZEC APP/11, code-level security is a clear example of this. Reviewing the security of ABAP custom developments is critical. Another weak link: The SAP technical layer (NetWeaver/BASIS). Base framework in charge of critical tasks such as authentication, authorization, encryption, interfacing, auditing, logging, etc. Can be susceptible of security vulnerabilities that, if exploited, can lead to espionage, sabotage and fraud attacks to the business information.
3 BIZEC APP/11 BIZEC APP/11 Version 2.0 (Content and research contributed by Virtual Forge, Germany)
4 What is BIZEC APP/11? The BIZEC APP/11 standard comprises the most critical and the most common security defects in SAP ABAP applications. Its purpose is to give companies that plan to conduct ABAP code audits guidance which types of security defects should be covered at minimum by an audit.
5 Why (yet) another standard? Existing standards Cover risks that don t exist in ABAP Buffer overflows Authentication issues Don t cover risks that are specific to ABAP Authorization-related risks Client concept Have a different scope Web-specific (WASC, OWASP) Generic (SANS CWE) Facit: Other application security standards are not applicable to ERP systems.
6 Why we revised the APP/11 list New threat profile Research yielded new risks like Native SQL Injection New SAP technologies mitigate certain risks Substantial increase of analyzed code base More than 100 Mio lines of code More than 50 companies contributed code More contributors SAP security researchers SAP experts from the industry
7 Results of code analysis Priority based on Critical Findings, not Total Findings New items: SQL Injection (Native), Direct Database Modifications, Hidden ABAP Code Dropped items: File Upload (Malware), Cross-Site Request Forgery, Unmanaged SQL
8 BIZEC Protection goals for ERP Systems (#1) PG-1 Confidentiality of Business Data The confidentiality of business data must be protected. This is a key requirement in data protection laws and compliance standards, like e.g. PCI/DSS. Any read access to (sensitive) business data must be properly authorized. PG-2 Integrity of Business Data The integrity of all business data must be guaranteed. This is a key requirement for compliance and financial audits. Any (authorized) change of business data must also be accountable. PG-3 Privileges to execute Business Logic Execution of Business Logic must be protected by proper authorization controls. ABAP coding must duly enforce the required authorizations and must not bypass the authorization concept of the Business Runtime. Cascading effect: PG-1 and PG-2 will also be violated. PG-4 Accountability of the Business Logic All (authorized) actions performed by the Business Logic must be accountable. ABAP coding must not bypass the accountability features provided by the Business Runtime.
9 BIZEC Protection goals for ERP Systems (#2) PG-5 Integrity of the Business Logic The Integrity of the business logic must be protected in order to prevent manipulation. ABAP coding must neither accidentally nor intentionally bypass/undermine security features of the Business Runtime. Cascading effect: PG-1, PG-2, PG-3 and PG-4 will also be violated. PG-6 Availability of the Business Runtime The Business Runtime is the base platform for the execution of the Business Logic and Business Data layers. Therefore, the availability of the Business Runtime is a critical requirement for the overall operational health of the system. Successful DOS attacks to the components in this layer will result in unexpected downtimes, preventing the Organization's users or systems from using the entire SAP system. PG-7 Integrity of the Business Runtime The integrity of the components in this layer must be enforced and controlled, as any unauthorized modification in them imply high-level risks to the confidentiality, integrity and availability of the information used by the Business Data and Business layers. Cascading effect: All other protection goals will also be violated.
10 BIZEC APP/11 2012 in detail (#1) APP-01 ABAP Command Injection Critical Coding that dynamically creates and executes ABAP programs based on user input on a productive system, bypassing SE80 and the concept of a three-tier-system landscape. Violates: PG-1, PG-2, PG-3, PG-4, PG-5, PG-6, PG-7 Exemplary SAP Note: 1589919 APP-02 OS Command Injection Critical Coding that executes arbitrary (input-based) commands on the operating system, bypassing the allowed commands specified in SM49/SM69 and S_LOG_COM authorizations. Violates: PG-6, PG-7 Exemplary SAP Note: 1520462 APP-03 Native SQL Injection Critical Coding that executes arbitrary (input-based) native SQL commands on the SAP database, bypassing any Open SQL restriction. Violates: PG-1, PG-2, PG-4, PG-6, PG-7 Exemplary SAP Note: 1456569
11 BIZEC APP/11 2012 in detail (#2) APP-04 Improper Authorization (Missing, Broken, Proprietary, Generic) Common Coding that does not (properly) perform authorization checks based on the SAP standard for critical operations. Improper Authorization includes semantically incorrect authority checks, generic authority checks, missing as well as proprietary authorization checks. Violates: PG-3 (implicitly PG-1, PG-2) Exemplary SAP Note: 1576763 APP-05 Directory Traversal Common Coding that performs server-side file/directory read/write access, where a file name or path is (partially) based on unvalidated user input. Such coding gives attackers read/write access to restricted files, e.g. OS configuration, SAP configuration and temporarily stored business data. Violates: PG-1, PG-6, PG-7 Exemplary SAP Note: 1595074
12 BIZEC APP/11 2012 in detail (#3) APP-06 Direct Database Modifications Common Coding that directly modifies (restricted SAP standard) database tables without proper authorizations, bypassing S_TABU_DIS, S_TABU_NAM and S_TABU_CLI authorizations. Violates: PG-2 Exemplary SAP Note: not known. Problem specific to custom code. APP-07 Cross-Client Database Access Common Coding that accesses business data on a different client, bypassing the SAP client separation mechanism. Violates: PG-5 (implicitly PG-1, PG-2, PG-3, PG-4) Exemplary SAP Note: not known
13 BIZEC APP/11 2012 in detail (#4) APP-08 Open SQL Injection Common Coding that makes use of dynamic Open SQL, where part of such a query is based on input. This defect enables malicious users to alter the SQL query in order to access restricted data without authorization. Violates: PG-5 (implicitly PG-1, PG-2, PG-3, PG-4) Exemplary SAP Note: 1447616 APP-09 Generic Module Execution Common Coding that allows uncontrolled execution of SAP standard business modules. The SAP standard provides a large number of business modules in the basis as well as the business suite. Execution of these business modules is restricted by SAP standard security features, e.g. SE37, SE38/SA38 and SE80. Violates: PG-3 (implicitly PG-1, PG-2) Exemplary SAP Note: 1683644
14 BIZEC APP/11 2012 in detail (#5) APP-10 Cross-Site Scripting Common (BSP) Coding that does not properly encode data before rendering it as HTML. Cross-Site Scripting (XSS) attacks are targeted at users that run business applications in Web browsers. An XSS vulnerability compromises the security of the attacked user's client system, affecting any active SAP sessions. Violates: PG-1, PG-2, PG-3, PG-4, PG-5, PG-6, PG-7 Exemplary SAP Note: 1337913 APP-11 Obscure ABAP Code Common Any coding that uses stealth techniques in order to obscure its true purpose. Violates: PG-4 Exemplary SAP Note: not known. Problem specific to custom code.
15 BIZEC TEC/11 BIZEC TEC/11 Version 2.0 (Content and research contributed by Onapsis, USA)
16 BIZEC TEC/11 (2012) The BIZEC TEC/11 project lists the most common and critical security defects and threats affecting the technical layer of SAP platforms. Several of the presented threats can be exploited by attackers who do not even have a valid SAP user in the system! Because of the technical layer being the foundation of the business logic, a successful exploitation of several of these vulnerabilities would usually result in a complete compromise of the business information and processes (SAP_ALL privileges or equivalent). Several affect both SAP ABAP and Java-based solutions. The first list was presented on May 2010, and it has been updated, after two additional years of real-world SAP security assessments and knowledge exchange with other experts.
17 BIZEC TEC/11 (2012) The BIZEC TEC/11 BIZEC TEC-01: Missing SAP Security Notes BIZEC TEC-02: Standard SAP Users with Default Passwords BIZEC TEC-03: Dangerous SAP Web Applications BIZEC TEC-04: Unsecured SAP Gateway BIZEC TEC-05: Unsecured SAP/Oracle authentication BIZEC TEC-06: Insecure SAP RFC interfaces BIZEC TEC-07: Unsecured SAP Message Server BIZEC TEC-08: Insecure SAP Administration and Monitoring Services BIZEC TEC-09: Insecure SAP Network Filtering BIZEC TEC-10: Insecure SAProuter Implementation BIZEC TEC-11: Unencrypted SAP Communications
18 BIZEC TEC/11 (2012) BIZEC TEC-01: Missing SAP Security Patches Risk The SAP platform is running based on technological components whose versions are affected by reported security vulnerabilities and the respective SAP Security Notes have not been applied. Business Impact Attackers would be able to exploit reported security vulnerabilities and perform unauthorized activities over the business information processed by the affected SAP system.
19 BIZEC TEC/11 (2012) BIZEC TEC-01: Missing SAP Security Patches
20 BIZEC TEC/11 (2012) BIZEC TEC-02: Standard Users with Default Passwords Risk Users created automatically during the SAP system installation, or other administrative procedures, are configured with default, publicly known passwords. Business Impact Attackers would be able to login to the affected SAP system using a standard SAP user account. As these accounts are usually highly privileged, the business information would be exposed to espionage, sabotage and fraud attacks.
21 BIZEC TEC/11 (2012) BIZEC TEC-03: Dangerous SAP Web Applications Risk The SAP Application Server is providing Web applications with reported security vulnerabilities or sensitive functionality (XSS, SQL Injection, Invoker Servlet detour, Verb Tampering, XXE Tunneling, etc.) Business Impact Attackers would be able to exploit vulnerabilities in SAP Web applications, enabling them to perform unauthorized activities over the business information processed by the affected SAP system. Should these SAP Web Applications be accessible from untrusted networks, such as the Internet, the probability of attacks is highly increased.
23 BIZEC TEC/11 (2012) BIZEC TEC-04: Unsecured SAP Gateway Risk The SAP Application Server s Gateway is not restricting the starting, registration and/or cancellation of external RFC servers. Business Impact Attackers would be able to obtain full control of the SAP system. Furthermore, they would be able to intercept and manipulate RFC interfaces used for transmitting sensitive business information.
24 BIZEC TEC/11 (2012) BIZEC TEC-05: Unsecured SAP/Oracle authentication Risk The SAP ABAP Application Server authenticates to the Oracle database through the external OS authentication scheme, and the Oracle s listener has not been secured. Business Impact Attackers would be able to obtain full control of the affected SAP system s database, enabling them to create, visualize, modify and/or delete any business information processed by the system.
25 BIZEC TEC/11 (2012) BIZEC TEC-06: Insecure SAP RFC interfaces Risk The SAP environment is using insecure RFC connections from systems of lower security-classification level to systems with higher securityclassification levels (i.e. from Development to Production). Business Impact Attackers would be able to perform RFC pivoting attacks, by first compromising an SAP system with low security-classification and, subsequently, abusing existing insecure RFC interfaces to compromise SAP systems with higher security-classification levels.
26 BIZEC TEC/11 (2012) BIZEC TEC-06: Insecure SAP RFC interfaces
27 BIZEC TEC/11 (2012) BIZEC TEC-07: Unsecured SAP Message Server Risk The SAP System s Message Server is not restricting the registration of SAP Application Servers, therefore allowing access to unauthorized systems. Business Impact Attackers would be able to register malicious SAP Application Servers and perform man-in-the-middle attacks, being able to obtain valid user access credentials and sensitive business information. Attacks against the SAP system's user workstations would also be possible.
28 BIZEC TEC/11 (2012) BIZEC TEC-08: Insecure SAP Administration and Monitoring Services Risk The SAP platform is not protected against unauthorized access to sensitive administration or monitoring services, such as the SAP Management Console, the P4 interface, SDM, Solution Manager, Transport Management System, etc. Business Impact Attackers would be able to access sensitive functionality of the SAP system, which could lead to unauthorized activities over the business information processed by the affected SAP system.
29 BIZEC TEC/11 (2012) BIZEC TEC-09: Insecure SAP Network Filtering Risk The SAP platform network is not properly isolated from untrusted networks, both external and internal, and intrusion detection/prevention systems have not been implemented. Business Impact Attackers would be able to access administration or monitoring services and perform unauthorized activities over the affected SAP components, possibly leading to a full compromise of the SAP system. Due to the lack of IDS/IPS solutions, these attacks could stay undetected.
30 BIZEC TEC/11 (2012) BIZEC TEC-10: Insecure SAProuter Implementation Risk The SAProuter Route Permission Table is not properly configured to allow connections only from/to authorized systems, restricting the use of native protocols and/or logging features are not properly configured. Business Impact Attackers would be able to access SAP (and possibly non-sap) systems located in the Company's network.
31 BIZEC TEC/11 (2012) BIZEC TEC-10: Insecure SAProuter Implementation
32 BIZEC TEC/11 (2012) BIZEC TEC-11: Unencrypted SAP Communications Risk The confidentiality and integrity of communications in the SAP landscape is not enforced. These communications comprise SAP-to-SAP connections as well as interactions between SAP servers and external systems, such as user workstations and third-party systems. Business Impact Attackers would be able to access sensitive technical and business information being transferred to/from the SAP environment.
33 Thank you for your feedback We are looking forward to meeting you at our next event. Further information on BIZEC and BIZEC events: http://bizec.org.
34 Disclaimer SAP, ABAP and other named SAP products and services and their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries worldwide. All other names of products and services are trademarks of their respective companies / owners. Information contained in this publication is not binding and serves information purposes only. All information can be changed without notice.