50,000 companies exposed to hacks of 'business critical' SAP systems: researchers

guest · May 2, 2019

50,000 companies exposed to hacks of 'business critical' SAP systems: researchers
May 2, 2019
https://www.reuters.com/article/us-...ritical-sap-systems-researchers-idUSKCN1S80VJ

Up to 50,000 companies running SAP software are at greater risk of being hacked after security researchers found new ways to exploit vulnerabilities of systems that haven’t been properly protected and published the tools to do so online.

Security experts say attacks on those systems could be hugely damaging, both for the victim organizations and their wider supply chain. SAP customers collectively distribute 78 percent of the world’s food and 82 percent of global medical devices, the company says on its website.
CRITICAL SYSTEMS
Researchers at Onapsis said on Thursday they were naming the exploits “10KBLAZE” because of the threat they posed to “business-critical applications” which, if hacked, could result in “material misstatements” in U.S. financial filings.
Click to expand...

Nunez said he would share his company's ability to detect the vulnerabilities with other security vendors to help secure all SAP users against possible future attacks. Full details here www.onapsis.com/10kblaze
Click to expand...

guest · May 2, 2019

Public 10KBLAZE Exploits May Impact 90% of SAP Production Systems
May 2, 2019
https://www.bleepingcomputer.com/ne...-impact-90-percent-of-sap-production-systems/

The 10KBLAZE set of exploits do not target security vulnerabilities present in the SAP code but "administrative misconfigurations of SAP NetWeaver installations (including S4/HANA)," according to Onapsis' threat report [PDF] which also contains technical vulnerability details.

The only requirement to exploit the security flaws which impact the SAP production systems of an estimated number of 50,000 companies is for the potential attackers to have network access to the vulnerable SAP production systems.
Potential attackers who would be capable of performing various critical business transactions, while also having the possibility to completely erase all the traces left on the compromised SAP environments

Onapsis Research Labs also "released two open source Snort signatures [ZIP] to provide all SAP customers a detection mechanism that can be used to monitor system risk while misconfigurations are being addressed [...]
Click to expand...

Onapsis' threat report (PDF - 329 KB): http://go.onapsis.com/l/127021/2019-05-02/3rjzcq/127021/123437/10KBLAZEThreatReport.pdf

Log in or Sign up

50,000 companies exposed to hacks of 'business critical' SAP systems: researchers

guest Guest

guest Guest

Log in or Sign up

50,000 companies exposed to hacks of 'business critical' SAP systems: researchers

guest Guest

guest Guest

Useful Searches