27C3 - Version 1.6.3
27th Chaos Communication Congress
We come in peace
| Speakers | |
|---|---|
|
Ertunga Arsal |
| Schedule | |
|---|---|
| Day | Day 1 - 2010-12-27 |
| Room | Saal 3 |
| Start time | 23:00 |
| Duration | 01:00 |
| Info | |
| ID | 4082 |
| Event type | Lecture |
| Track | Hacking |
| Language used for presentation | English |
| Feedback | |
|---|---|
|
Did you attend this event? Give Feedback |
Rootkits and Trojans on Your SAP Landscape
SAP Security and the Enterprise
SAP systems are the heart of many enterprises. Most critical business functions run on SAP Applications and the complexity of these systems makes it very difficult to protect against attackers. Default setups, forgotten/unimplemented security configurations, weak password management and change processes that apply to one ‘unimportant’ system can result in complete compromise of the SAP landscape.
The legal consequences, lost/damaged business and reputation can be disastrous depending on the type of the attack. While companies invest a lot to secure SAP systems at business process level for example by designing authorization concepts, implementing separation of duties or by using GRC (Governance Risk and Compliance) tools, the security at technical level mostly lacks attention. In this paper, I present several attack paths exploiting configuration weaknesses at technical level, leading to attack potential to single systems, to whole SAP landscapes, and finally the whole enterprise network. By demonstrating creative exploit variants of configuration weaknesses, I motivate the necessity to safeguard a SAP system at technical level.