Boston, MA – November 9, 2015 – Onapsis, the global experts in SAP and Oracle business-critical application security, today released 21 new security advisories detailing an unprecedented number of vulnerabilities affecting all SAP HANA-based applications, including SAP S/4HANA and SAP Cloud solutions running on HANA. Highlighted in the security advisories from Onapsis Research Labs™ are eight “critical risk” vulnerabilities, six of them comprising by-design vulnerabilities in SAP HANA which require system configuration changes in order to be mitigated. Without these changes, unauthenticated attackers could take full control of vulnerable SAP HANA systems, including stealing, deleting or changing business information, as well as taking the platform offline to disrupt key business processes. This is the first time that advisories with the highest level of criticality, combined with the largest number of vulnerabilities, have been issued for SAP HANA.
These vulnerabilities pose a potential risk to over 10,000 SAP customers running different versions of SAP HANA, including many Forbes Global 2000 companies across all industries such as oil and gas, pharmaceuticals, government and other key sectors. Experts have estimated that an SAP breach and outage could cost certain organizations up to $22 million per minute, including disruption of manufacturing and distribution of core products as well as loss of IP and data. Exploitation of SAP HANA vulnerabilities could significantly impact the global economy as it presents avenues of attacks for nation-states, economic espionage, financial fraud or sabotage of key business systems.
“The next big wave of attacks is aimed at business-critical applications running on SAP and Oracle as they are the ultimate economic targets for cyber crime. They are also currently the biggest blind spot for many Chief Information Security Officers (CISOs). SAP-related breaches are increasingly in the spotlight as witnessed in the first widely and publicly reported breach involving USIS, a supplier of OPM and DHS,” said Mariano Nunez, CEO, Onapsis. “Onapsis is a dedicated SAP partner and is committed to working closely with SAP and its customers to help safeguard their crown jewels and reduce business risks affecting their organizations. Thanks to our cutting-edge research, SAP released security patches and guidelines so that customers can now be protected. We are potentially helping avoid a large-scale breach that could have major consequences for SAP customers and are allowing them to continue to realize the value of their SAP HANA investment.”
Onapsis customers who leverage the Onapsis Security Platform’s Advanced Threat Protection service have had protection against these threats since the vulnerabilities were discovered, helping them protect against zero-day SAP exploits and leverage the solution to deploy compensating controls for these hard-to-fix vulnerabilities.
The new HANA security advisories issued by Onapsis Research Labs include eight critical vulnerabilities, six high-risk vulnerabilities and seven medium-risk vulnerabilities. Many of the critical vulnerabilities are related to the core HANA TrexNet interfaces that orchestrate inter-server communication in high availability scenarios to support large-scale businesses. Because HANA is also becoming the underlying technology for all SAP applications, including SAP S/4HANA, and the SAP HANA Cloud Platform, and because it supports a vast third-party mobile application ecosystem, the attack surface expands exponentially with varying business impact.
SAP security experts within the Onapsis Research Labs have worked with hundreds of Global 2000 organizations to quantify the impact of these and other high-impact vulnerabilities through a capability called Business Risk Illustration (BRI). This service efficiently analyzes threats on the availability, integrity and confidentiality of SAP business data and processes.
“It is imperative that the industry starts getting serious about SAP cybersecurity. This set of critical vulnerabilities is one of the most profound that we’ve reported in terms of damage that an unauthenticated attacker could cause an organization. If exploited, any business information stored or managed by an SAP HANA-based system could be extracted, tampered and deleted, including customer data, product pricing, financial statements, employee information, supply chain, business intelligence, intellectual property, budgeting, planning and forecasting. Furthermore, the system could be completely shut down by an attacker,” said Juan Perez-Etchegoyen, CTO, Onapsis.
Top Recommendations for CISO’s
Some of these vulnerabilities cannot be fixed by applying patches and the affected HANA TrexNet service cannot be shut down. A proper reconfiguration of the system is the only fix and must be implemented correctly. In addition to reviewing the SAP security notes issued, Onapsis Research Labs recommends SAP clients remedy these issues by completing the following steps:
The remaining critical vulnerabilities, which are not related to the TrexNet protocol, should be patched according to the SAP Security Notes. SAP has issued the following security notes related to the described vulnerabilities: 2165583, 2148854, 2175928, 2197397 and 2197428. Onapsis encourages SAP customers to review and apply them as soon as possible.
SAP and Oracle Security Threat Intelligence is produced by Onapsis Research Labs, a team of leading security experts who combine in-depth knowledge and experience to deliver technical analysis with business context, and provide sound security judgment to the market. The team works closely with SAP and Oracle product security teams to responsibly deliver the information to customers and has released over 250 advisories to date, with over 35 affecting SAP HANA; has consulted on impact with over 180 Onapsis enterprise customers; and regularly presents at leading security and SAP conferences around the world. Onapsis was the first to deliver “SAP Security In Depth” publications that provide detailed analysis on security risks impacting SAP and SAP HANA. The latest SAP Security In-Depth, Volume XII: SAP HANA System Security Review Part 1, is now available for download: https://www.onapsis.com/research/publications/volume-xii-sap-hana-system....
Onapsis provides the most comprehensive solutions for securing SAP and Oracle enterprise applications. As the leading experts in SAP and Oracle cyber-security, Onapsis’ enables security and audit teams to have visibility, confidence and control of advanced threats, cyber-risks and compliance gaps affecting their enterprise applications.
Headquartered in Boston, Onapsis serves over 180 Global 2000 customers, including 10 top retailers, 20 top energy firms and 20 top manufacturers. Onapsis’ solutions are also the de-facto standard for leading consulting and audit firms such as Accenture, IBM, Deloitte, E&Y, KPMG and PwC.
Onapsis solutions include the Onapsis Security Platform, which is the most widely-used SAP-certified cyber-security solution in the market. Unlike generic security products, Onapsis’ context-aware solutions deliver both preventative vulnerability and compliance controls, as well as real-time detection and incident response capabilities to reduce risks affecting critical business processes and data. Through open interfaces, the platform can be integrated with leading SIEM, GRC and network security products, seamlessly incorporating enterprise applications into existing vulnerability, risk and incident response management programs.
These solutions are powered by the Onapsis Research Labs which continuously provide leading intelligence on security threats affecting SAP and Oracle enterprise applications. Experts of the Onapsis Research Labs were the first to lecture on SAP cyber-attacks and have uncovered and helped fix hundreds of security vulnerabilities to-date affecting SAP Business Suite, SAP HANA, SAP Cloud and SAP Mobile applications, as well as Oracle JD Edwards and Oracle E-Business Suite platforms.
For more information, please visit www.onapsis.com, or connect with us on Twitter, Google+, or LinkedIn.