Latest / Onapsis Podcast / Protecting Brand Value: An Executive Threat Briefing on SAP Security

Transcript

Protecting Brand Value: An Executive Threat Briefing on SAP Security · Onapsis Podcast

• 0:00
  Speaker 1: Hello everyone, thanks for joining today's webinar on protecting brand value through SAP security.
• 0:07
  Speaker 1: My name is Angelica Cubel and I'll be managing the day session.
• 0:11
  Speaker 1: Before we get started i have some housekeeping notes.
• 0:14
  Speaker 1: First ,I want to point out a questions module within the ON-TWENTYFOUR platform.
• 0:19
  Speaker 1: We welcome you enter your question at any points during this presentation And if time allows .We will answer whatever questions we can.
• 0:29
  Speaker 1: You can always adjust the size of a media player to make it bigger or smaller depending on your preference.
• 0:36
  Speaker 1: And finally, please note that this session is being recorded and we'll share our links in this session after we wrap up today!
• 0:44
  Speaker 1: Now I'm going to pass it over to our presenter.
• 0:47
  Speaker 1: with us Today We have Paula Laodansi who will be sharing critical insights on SAP security for luxury organizations.
• 0:55
  Speaker 1: It will be diving deep into the evolving threat landscape.
• 1:00
  Speaker 1: The business impact of SAP breaches on brand reputation and client trust, and practical steps you can take to strengthen your security posture while protecting the operational precision that defines our
• 1:12
  Speaker 1: organization.".
• 1:13
  Speaker 1: And with that I'll hand it over to Paul.
• 1:17
  Speaker 0: Thank You very much!
• 1:25
  Speaker 0: And I'm very excited to be able to talk about passions that I have around relationships, passions that i have around demonstrating and translating those relationships in a secure way especially when it comes to doing things with customers.
• 1:44
  Speaker 0: In an online world.
• 1:46
  Speaker 0: so It's my joy To Be Able To Talk To You About Protecting Brand Value.
• 1:52
  Speaker 0: An Executive Threat Briefing on SAP Security.
• 1:58
  Speaker 0: a little bit about myself.
• 1:59
  Speaker 0: So as I said, I love relationships and think that is so important to anything we do out there in the world whether through personal connections or business connections or managing brand.
• 2:15
  Speaker 0: Part of what my team does here at the onapsis research labs We take look at threats targeting SAP.
• 2:26
  Speaker 0: we try to understand those threats and make sure that we address those threats working with SAP, so when the attackers tried to find them themselves.
• 2:38
  Speaker 0: The reality is that we were able to get them patched working with SAP a fantastic partner in this journey.
• 2:46
  Speaker 0: There's a lot of other things I am familiar with have experience as you could see here.
• 2:52
  Speaker 0: all these are really tied too fundamentally relationships because relationships matter.
• 2:58
  Speaker 0: If in order to build trust, you have to show up each and every day personal and a business as someone or a business that is trustworthy?
• 3:09
  Speaker 0: And that's the journey I'm going take on here during this presentation.
• 3:14
  Speaker 0: It's about demonstrating how attackers understand The importance of relationship.
• 3:20
  Speaker 0: They understand what it means out there in the business marketplace and how to leverage that relationship.
• 3:29
  Speaker 0: To try an get what they want, which ultimately is data or finance money will go ahead and dive into that.
• 3:41
  Speaker 0: first a little bit about the onapsis research labs.
• 3:45
  Speaker 0: more than I've mentioned.
• 3:47
  Speaker 0: we've been around for quite awhile.
• 3:49
  Speaker 0: We are vulnerability research into SAP.
• 3:57
  Speaker 0: We do a lot more things than research in to SAP and ERP, we do professional services with black box gray box and white box penetration testing.
• 4:08
  Speaker 0: so we are that third party so-to speak.
• 4:11
  Speaker 0: they could come in pressure test systems make sure of the day or safe secure before attackers have chance to step in potentially breach which is a lot of what we've seen in twenty-twenty five.
• 4:29
  Speaker 0: We partner with SAP Product Security Response Team, we partner with CESA and BSI over the research that we do on our global threat intel network.
• 4:44
  Speaker 0: Throughout the lifetime We've got lots of knowledge base articles, a lot of information that ultimately leads to us sharing that with our customers in the Onapsus platform as well as again working with partners like SAP.
• 5:09
  Speaker 0: Probably the biggest relationship factor that I want point out is a few years ago when we would present at some of these conferences listed here Black Hat Def Con troopers, especially Black Hat and DefCon.
• 5:27
  Speaker 0: People in the audience didn't really understand what SAP was but that's changed.
• 5:32
  Speaker 0: so even in the Audience everyone seems to be aware of What SAP is?
• 5:38
  Speaker 0: What SAP manages and understands.
• 5:40
  Speaker 0: That data that SAP works with Is a business critical asset To any company.
• 5:52
  Speaker 0: Okay this slide SAP is the digital nervous system of your Maison.
• 6:00
  Speaker 0: I've had to think about this a little bit, and-and this slide really stood out to me in terms of relationships right?
• 6:09
  Speaker 0: So when we take a look at the supply chain... When We Take A Look At The Client Registry.. When We TAKE A LOOK AT THE RETAIL OPERATIONS AND THE MARKET INTEGRITY That's All About Protecting The Product.
• 6:23
  Speaker 0: When we see SAP as the digital nervous system of your Maison, it's protecting the product.
• 6:30
  Speaker 0: Protecting your clientele.
• 6:33
  Speaker 0: It's protecting The experience Of Your clientele right whether they go into those boutique networks or do They Go Into the e-commerce platforms?
• 6:45
  Speaker 0: We really want to ensure that As an organization were able To protect That shopping experience.
• 6:54
  Speaker 0: It's important that brand relationship is so important for consumers and That's the last part, right?
• 7:01
  Speaker 0: The market integrity.
• 7:03
  Speaker 0: it's all about protecting to brand.
• 7:05
  Speaker 0: So it's important for us To make sure that you get the best out of SAP security And SAP threat intelligence in order to apply it and maintain and curate and nourish The protection of the product, the protection of clientele especially high value net worth customers.
• 7:29
  Speaker 0: Protecting experience that people have with your brands and protecting again brand itself.
• 7:40
  Speaker 0: one primary note here uh bottom part right it's threat actors understand this.
• 7:51
  Speaker 0: they're targeting.
• 7:54
  Speaker 0: not only do people at these conferences now know what SAP is, the threat actors do as well.
• 8:02
  Speaker 0: We actually have research into The Threat Actor Dark Marketplace—the deep and dark forums It's called the Chatter Report.
• 8:12
  Speaker 0: That something that you can access off of Anapsis.com?
• 8:16
  Speaker 0: That's Something You Can Look At from a non-demand webinar.
• 8:19
  Speaker 0: we dive in to that world And explore how these threat Actors are becoming aware of SAP and how they're getting infiltrated into companies to be able to deploy ransomware in environments that have SAP.
• 8:40
  Speaker 0: Here's our agenda, so we are going talk about why SAP security is brand security kind of talked a little bit here.
• 8:49
  Speaker 0: the twenty-twenty five vulnerability landscape were gonna look at how twenty.
• 8:56
  Speaker 0: twenty five has been an epic year for SAP.
• 9:01
  Speaker 0: The new threat actors targeting luxury, the anatomy of real SAP breaches and luxury specific business impact.
• 9:10
  Speaker 0: And finally we'll have a roadmap to resilience with assess control and defend.
• 9:16
  Speaker 0: those are components of the onapsis platform.
• 9:19
  Speaker 0: in We the onpsis research labs were that tip-of-the spear.
• 9:24
  Speaker 0: So the work that we do gets fed directly into that where OOP, Onapsis Platform has information based off of our global threat intel network.
• 9:36
  Speaker 0: The Threat Intel which we vet and curate to make sure it's high quality as well is the information that we get when working on vulnerabilities And we're working with SAP to patch them.
• 9:51
  Speaker 0: Okay So It's a different type risk for luxury.
• 9:57
  Speaker 0: When it comes to SAP vulnerability We need to understand SAP is changing, right?
• 10:07
  Speaker 0: From one perspective.
• 10:08
  Speaker 0: There's the on-prem.
• 10:10
  Speaker 0: there's a journey to rise in the cloud.
• 10:14
  Speaker 0: In any case whether it's On-Prem Rise with Cloud or if its hybrid there's always going be component for responsibility by The client.
• 10:30
  Speaker 0: Right and on prem you have to kind of manage everything the host, that network.
• 10:35
  Speaker 0: The firewalls SAP itself whole supply chain and rise with SAP.
• 10:44
  Speaker 0: there's still components.
• 10:45
  Speaker 0: you still have to have skin in a game for protecting SAP.
• 10:51
  Speaker 0: And then the hybrid piece right?
• 10:53
  Speaker 0: You got to worry about the integrations you gotta worry about configurations.
• 10:58
  Speaker 0: however With That said some of things we've seen and some of the things that we protect, and test in pentest environments are where for instance attackers can come into SAP and find a low-privileged user.
• 11:18
  Speaker 0: They can gain entry to that low privileged user.
• 11:22
  Speaker 0: then they go ahead and escalate from that low privilege account.
• 11:25
  Speaker 0: They access full admin privileges by bypass existing SOD and access controls And we found that there might not be any activity, any logging of that activity.
• 11:41
  Speaker 0: So once that happens and these threat actors can reach this full admin privileges that can lead to exposure of client data.
• 11:51
  Speaker 0: ultra high net worth customers.
• 11:53
  Speaker 0: That's the experience for trying to protect us The brand as the trust that I spoke about.
• 11:59
  Speaker 0: right when We show up Being able to be trusted every day that continues the legacy of brands being able to Be trusted no matter where we are in a journey In technology or modernization.
• 12:17
  Speaker 0: We want to protect those private purchase histories The lists, and we don't want them leaking right?
• 12:35
  Speaker 0: being protected for SAP that's not being monitored, right?
• 12:39
  Speaker 0: Things can happen sadly and the company may not even realize it.
• 12:44
  Speaker 0: And that's why we're here today to talk about these things now.
• 12:49
  Speaker 0: That breach of client discretion Can absolutely lead to brand liability.
• 12:56
  Speaker 0: It can leads a brand damage.
• 12:58
  Speaker 0: They can lead to regulatory damage.
• 13:01
  Speaker 0: The brand mystique can be permanently eroded.
• 13:05
  Speaker 0: that took so long and, and it's hard to build throughout the years.
• 13:12
  Speaker 0: Throughout the decades... That can be lost!
• 13:16
  Speaker 0: We don't want that happen to anybody which is why we do me in my team-we do what we do because were very passionate..We wanna make the internet a safe
• 13:25
  Speaker 0: place!!
• 13:26
  Speaker 0: We wanna make companies a safe
• 13:28
  Speaker 0: places!!!
• 13:28
  Speaker 0: We do that through demonstrating our efforts within SAP security.
• 13:35
  Speaker 0: Let's keep the trust Let's keep the integrity of the data and we'll walk through what that looks like.
• 13:49
  Speaker 0: There is a risk calculation, it's risk equals probability times impact And now will give you your risk score.
• 13:58
  Speaker 0: Now You can define What Your Appetite Is For A Risk Score Which Are Comfortable With.
• 14:05
  Speaker 0: But The Important Thing Is To Understand The Threat Landscape To Understand YOUR Environment to understand if you have vulnerability management program or processes in place, as well as monitoring.
• 14:20
  Speaker 0: You want to make sure that SAP is integrated into your existing information security processes?
• 14:28
  Speaker 0: Do we wanna make sure they are taking a look at and understanding what the attack vectors looked like who threat actors are targeting SAP?
• 14:41
  Speaker 0: You want to understand the manual, as well as the automated SAP vulnerabilities that can be exploited and understand what it is that these threat actors are going after.
• 14:52
  Speaker 0: We'll double click on those.
• 14:54
  Speaker 0: Josso we wanna talk about the impact right?
• 14:59
  Speaker 0: The impact Can Be Chaotic It Can Be Epic And They Can Be Damaging.
• 15:06
  Speaker 0: So prior to twenty-twenty five.
• 15:08
  Speaker 0: when I've done Threat Briefings I've often been asked the question, well what's the real impact?
• 15:14
  Speaker 0: Onapsis research labs.
• 15:16
  Speaker 0: we do respond to incidents.
• 15:18
  Speaker 0: We do respond breaches.
• 15:20
  Speaker 0: You can't talk about those—those are confidential!
• 15:24
  Speaker 0: However, twenty-twenty five was a game changer and in Twenty-Twenty Five…we're seeing public announcements of companies that have been breached.
• 15:37
  Speaker 0: Prior to Twenty-twty-five …I would not use this phrase.
• 15:42
  Speaker 0: But as of twenty-twenty five, those public breaches.
• 15:46
  Speaker 0: Those public incidents.
• 15:48
  Speaker 0: Those Public bankruptcies they become a cautionary tale and so all of the sudden that adds more depth And that increases in ads to the passion we have.
• 16:02
  Speaker 0: make sure We disseminate timely threat intelligence To everybody because we don't want people to be an example of a cautionary tale.
• 16:18
  Speaker 0: It's not a good place to be, and in some of these instances the breaches themselves are still felt in the long tail which is remarkable in this day-and-age.
• 16:35
  Speaker 0: Okay let's go ahead into that.
• 16:38
  Speaker 0: vulnerabilities.
• 16:39
  Speaker 0: In twenty twenty five it was hands down The most epic year in SAP's history.
• 16:48
  Speaker 0: We saw a big increase in vulnerabilities and the emergence of the deserialization attack as the number one critical threat, we have a little snapshot here of November.
• 17:04
  Speaker 0: And November was pretty big deal because it led to this CVSS-TEN score at top security hardening for insecure deserialsation in SAP NetWeaver, AS Java.
• 17:20
  Speaker 0: So this java deserialization attack is big zero day.
• 17:24
  Speaker 0: it's the CVE.
• 17:26
  Speaker 0: twenty-twenty five three one three two four.
• 17:30
  Speaker 0: that was the first CVE that acknowledged This Zero Day and attempted to patch The Zero Day And In That the attackers were able to successfully compromise hundreds of companies.
• 17:48
  Speaker 0: We worked with incident response companies, we work directly with customers when they've been breached by the zero day.
• 17:58
  Speaker 0: It was a pretty big deal and it is so sophisticated!
• 18:03
  Speaker 0: And it was closed...it was being leveraged by nation-state actors from Russia and from China.
• 18:12
  Speaker 0: but ultimately there's been a couple of releases one of them that we worked intimately with SAP to make sure the root cause for this zero day was being addressed.
• 18:34
  Speaker 0: A little snapshot, a bit of chart going back throughout years... We could see in twenty-twenty five is big milestone spike and my research labs discovered forty four percent all critical hot news.
• 18:53
  Speaker 0: SAP vulnerabilities Got a great team.
• 18:57
  Speaker 0: I love my team!
• 18:59
  Speaker 0: I Love what we do, We have A lot of fun?
• 19:01
  Speaker 0: We've got A lot Of teamwork Transparency Comradery And it's Great Where We can get Together and Do the things that We love.
• 19:11
  Speaker 0: The output of That comes straight to you.
• 19:17
  Speaker 0: So this slide.
• 19:20
  Speaker 0: i like To bring up This Slide Because It Does Talk About CWE or common weakness enumeration.
• 19:32
  Speaker 0: If we take a look over the past few years, will notice that some of the weaknesses have increased?
• 19:42
  Speaker 0: Some have shifted.
• 19:44
  Speaker 0: so these weaknesses are weaknesses in this software right like missing authorization.
• 19:52
  Speaker 0: So twenty-twenty two and twenty three it was number to but in last couple and that means there might be some code, but it's not doing an authorization check.
• 20:09
  Speaker 0: There is no authorization so anyone even with a low-privileged user role can come in to run an injection attack against your SAP.
• 20:24
  Speaker 0: that can then essentially do bad things we don't want.
• 20:29
  Speaker 0: but we can see what's been the focus of these patches over the last four years at cross-site scripting.
• 20:39
  Speaker 0: It was number one in twenty, twenty three and it started to come down a little bit.
• 20:45
  Speaker 0: so that's good context to keep in mind when we take a look at twenty twenty five overall for this SAP security notes We have uh...over two hundred new an updated notes.
• 20:59
  Speaker 0: We have well over twenty-five hot news, forty two high priority notes average of three plus per month.
• 21:08
  Speaker 0: And then we kind of break that down.
• 21:10
  Speaker 0: the most patch components and vulnerability type SAP netweaver.
• 21:14
  Speaker 0: there we go we see the serialization any authorization checks yes for HANA solution manager business objects SAP commerce cross site scripting third party.
• 21:26
  Speaker 0: even like Tomcat In our contribution, we see that.
• 21:32
  Speaker 0: We love that were so embedded in with SAP that we work with finding these hot news and getting them patched before it gives the attackers the ability to find it themselves right?
• 21:49
  Speaker 0: The best thing is keep doing what you're doing and remove.
• 22:03
  Speaker 0: we're going to get into the big epic discussion about deserialization.
• 22:09
  Speaker 0: What exactly is the serialization?
• 22:13
  Speaker 0: It's taking data that's formatted in one way, putting it into another type of format so that he can be transmitted and worked with computers, then being able to reconstructed back.
• 22:27
  Speaker 0: but serialization and then deserialization, that's where this bug, this exploitation was used by these advanced attackers.
• 22:41
  Speaker 0: These nation state actors.
• 22:44
  Speaker 0: it led to being able to do a couple of different paths.
• 22:50
  Speaker 0: one path was to be able to drop a web shell through the initial entry point.
• 22:57
  Speaker 0: which Other path was to be able to execute remote code execution.
• 23:10
  Speaker 0: The interesting thing here is that when we spotted this, We started to look for other endpoints which where the number comes in When you take a look at numbers eight total deserializations seven criticals three with CVSS ten maximum severity of vulnerability can have.
• 23:31
  Speaker 0: And all of them are HTTP exploitable and they didn't have to be authenticated.
• 23:39
  Speaker 0: They were all discovered by the Anapsis Research Labs, so what that means is there's a lot different ways.
• 23:48
  Speaker 0: attackers can come into SAP through different applications or different HTTP locations but still deliver the same underlying root cause deserialization attack.
• 24:02
  Speaker 0: And it's that root cause, the serialization attack.
• 24:04
  Speaker 0: That was very hard for companies and incident responders to find because that deserialization attack doesn't leave a fingerprint on the system.
• 24:17
  Speaker 0: It doesn't even artifact what is left after.
• 24:21
  Speaker 0: did the serialisation attack as successful?
• 24:24
  Speaker 0: Is like that web shell.
• 24:26
  Speaker 0: so when this first got reported it got reported as, hey metadata uploader is the endpoint that has been attacked and look at the artifact.
• 24:37
  Speaker 0: It's a web shell.
• 24:38
  Speaker 0: so that can lead to false sense of security because didn't need understanding.
• 24:46
  Speaker 0: there was actually another format which is remote code.
• 24:50
  Speaker 0: execution may not mean any artifacts or evidence like a file, Like a web shell.
• 25:03
  Speaker 0: Okay Web application vulnerabilities the persistent attack surface.
• 25:11
  Speaker 0: So one of the most important things here to understand that when SAP is transitioning To web-based interfaces like Fiori commerce business objects this has expanded.
• 25:24
  Speaker 0: The web attacks surface significantly and That opens up cross-site scripting.
• 25:32
  Speaker 0: That opens up the SSRF, that opens up click jacking open redirects.
• 25:39
  Speaker 0: there's a lot more to manage.
• 25:41
  Speaker 0: how do you make sense of all that?
• 25:43
  Speaker 0: That's where the intelligence comes into play.
• 25:48
  Speaker 0: it's important to be able to understand the significance of these vulnerabilities and to be the new threat landscape for SAP.
• 26:10
  Speaker 0: So, for many years, Bonapsus, SAP, CISA we've been communicating to the broader audience that Thread Actors are targeting SAP.
• 26:26
  Speaker 0: again during our presentations at some of these conferences SAP was not well known but it is now and we discovered that in our chatter report, where threat actors being across a wide spectrum from the quote-unquote script kiddies who do not have the capability or understanding to craft their own exploits of vulnerabilities.
• 26:59
  Speaker 0: To advance threat actors hat can?
• 27:03
  Speaker 0: as well as nation-state actors that are well funded and well supported, and protected.
• 27:11
  Speaker 0: Chatter reveals that in twenty twenty five demonstrates on a global scale the havoc That they started to cause.
• 27:20
  Speaker 0: So there is no going back right.
• 27:22
  Speaker 0: it's here.
• 27:25
  Speaker 0: It doesn't matter if your SAP Is exposed publicly or not because these threat actors They're the same ones that come from outside of the SAP world.
• 27:39
  Speaker 0: These advanced threat actors know how to compromise IOTs, they know a zero-day in firewalls and are highly successful at getting into business enterprise environments not publicly exposed.
• 28:04
  Speaker 0: If SAP is not being managed, if it's not being monitored we see them attacking SAP and deploying ransomware holding companies to ransom because they know now that SAP manages business critical assets.
• 28:27
  Speaker 0: okay I'm gonna...I always love bringing up all the columns at once on this one where we did research in the underground.
• 28:41
  Speaker 0: I mentioned a little bit about our global threat intel network, Our Global Threat Intel Network.
• 28:48
  Speaker 0: We monitor that daily weekly monthly views...we look at what is currently under attack and What Is Currently Being Exploited?
• 28:59
  Speaker 0: So some of this information comes from The Research That We've Done In The Underground as well As the information that comes from our global threat intel network, and information that we get from working with customers.
• 29:14
  Speaker 0: In particular I want to start off with the M Trends report for twenty-twenty six states that The most frequently exploited vulnerabilities last year top of the list SAP NetWeaver.
• 29:31
  Speaker 0: this twenty twenty five three one three two four This Java serialization attack that took down hundreds of companies.
• 29:39
  Speaker 0: Then we see another ERP, Oracle e-Business Suite followed by Microsoft SharePoint.
• 29:46
  Speaker 0: So this is Another objective party well known from their own data.
• 29:55
  Speaker 0: That shows twenty twenty five was a banner year.
• 29:59
  Speaker 0: SAP has done fantastic being able to understand what the attacks are and be patch those attacks.
• 30:07
  Speaker 0: So make sure you are patching, patch-patch-pach.
• 30:13
  Speaker 0: I'm probably going to write a song about that.
• 30:15
  Speaker 0: maybe you'll hear it one day.
• 30:18
  Speaker 0: In our data we've seen over the past few years The attacks on SAP applications leveraging ransomware grow over four hundred percent.
• 30:29
  Speaker 0: We have seen when security notes get released That threat actors are exploiting them in less than seventy two hours.
• 30:38
  Speaker 0: We see the cost for black market prices for SAP exploits increased four hundred percent.
• 30:45
  Speaker 0: and When new systems are released, then they're not protected that.
• 30:49
  Speaker 0: They are discovered in compromised than less than three hours.
• 30:54
  Speaker 0: And of course all this is making news.
• 30:57
  Speaker 0: You know in prior years it might not have but it is now.
• 31:01
  Speaker 0: It is something that not only security professionals are aware of and threat actors are aware.
• 31:07
  Speaker 0: The press is highly tuned into this now as well.
• 31:12
  Speaker 0: And that, it's probably one of the things we don't want from a trust and brand management perspective.
• 31:19
  Speaker 0: so what can we ensure?
• 31:21
  Speaker 0: What can do to make sure you won't become a cautionary tale?
• 31:30
  Speaker 0: Here are some of the threat groups.
• 31:32
  Speaker 0: If I presented on these a couple years ago This list would be shorter But its not.
• 31:38
  Speaker 0: It has grown And it's grown with advanced threat actors.
• 31:41
  Speaker 0: It's grown nation state actors, with ransomware groups.
• 31:47
  Speaker 0: They're motivated to come after SAP.
• 31:50
  Speaker 0: they want to exploit the payment systems.
• 31:53
  Speaker 0: They are exfiltrating financial system and statements their pivoting.
• 32:00
  Speaker 0: a lot of these advance groups do have that knowledge capability for supply chain software outside of SAP.
• 32:11
  Speaker 0: They've simply taken their expertise and knowledge, and they're ability to adapt into the SAP landscape.
• 32:23
  Speaker 0: Shiny Hunters which was just on there one at last ones.
• 32:28
  Speaker 0: I'm going talk about them because they are an important third actor group dimension here as it comes.
• 32:33
  Speaker 0: two three-one-three-two four a big zero day.
• 32:36
  Speaker 0: first let's talk about this is a Kev catalog.
• 32:38
  Speaker 0: its the known exploited vulnerabilities catalog.
• 32:42
  Speaker 0: SISA maintains this list independently.
• 32:45
  Speaker 0: They confirm that they're CVEs, that are under active attack and exploitation.
• 32:51
  Speaker 0: some of these I believe even have a confirmation that their being used for ransomware campaigns.
• 32:58
  Speaker 0: you can visit sisa kev catalog an verify these yourselves too which is fantastic.
• 33:04
  Speaker 0: we love the scientific method.
• 33:06
  Speaker 0: We Love anybody been able to go in Verify information And this slide, you can certainly do that both with the table as well as the chart.
• 33:16
  Speaker 0: The chart is looking at the shadow server foundation's information.
• 33:20
  Speaker 0: they keep a global sensor network where they monitor what CVEs are under attack and so With the Shadow Server site What we did was we pivoted on SAP?
• 33:31
  Speaker 0: We took a look As to what their sensors were observing in twenty-twenty five.
• 33:37
  Speaker 0: You could see here Under August twenty-twenty five this peak That is directly related that blue.
• 33:46
  Speaker 0: Is directly related to three one, three two four prior?
• 33:50
  Speaker 0: To that spike there were two groups the China based and Russia based groups that had and we're exploiting The three one through two.
• 34:00
  Speaker 0: for once.
• 34:02
  Speaker 0: August came around.
• 34:03
  Speaker 0: shiny hunters released that exploit to the public And that had a cascading effect.
• 34:10
  Speaker 0: A lot of other of these CVEs were being picked up and observed as they were used to attack the sensors that Shadow Server maintains.
• 34:24
  Speaker 0: Of course, we've seen similar.
• 34:26
  Speaker 0: We like to pull in you know Other independent authorities To help validate and confirm.
• 34:34
  Speaker 0: Right, it makes sense.
• 34:35
  Speaker 0: We all live together in this global marketplace of this global commerce and It's good to share that information And get double checks.
• 34:44
  Speaker 0: The other important thing I want To mention is That In the CISA-CAV catalog A lot Of these were found by the onapsis research labs very fast pickup by the onapsis platform.
• 35:01
  Speaker 0: So we're able to help our customers very quickly because We have a research team that finds these.
• 35:09
  Speaker 0: The value of exploits they've gone up.
• 35:12
  Speaker 0: it is mind boggling That someone is looking for two hundred and fifty thousand dollars For an exploit targeting SAP remote code execution.
• 35:27
  Speaker 0: Wow You know.
• 35:32
  Speaker 0: Wow, if there's anything out There that tells you the threat actors are serious.
• 35:39
  Speaker 0: This is it.
• 35:42
  Speaker 0: Let let us put aside The fact that hundreds of companies were compromised the fact That their prices at these levels Is nuts.
• 35:54
  Speaker 0: We have a couple snapshots here.
• 35:56
  Speaker 0: There's a snapshot Here Of an exploit in the dark market SAP Secure Storage to find credentials, escalate privileges and eventually compromise another SAP system behind the first target.
• 36:15
  Speaker 0: Please be mindful that threat is real.
• 36:18
  Speaker 0: The thread is live!
• 36:19
  Speaker 0: The Thread Is Now!
• 36:25
  Speaker 0: Mandiant also provided a time-to-exploit trends affecting business applications.
• 36:33
  Speaker 0: like we've seen in our own global threat intel network is that the time to exploit does continue to decrease.
• 36:42
  Speaker 0: So, Threat Actors are getting faster and faster to be able to exploit vulnerabilities And more importantly older vulnerabilities are still a target.
• 36:55
  Speaker 0: Let me go back this prior slide.
• 36:59
  Speaker 0: We'll notice that bottom one CVE- Yes, we see that still under attack today.
• 37:08
  Speaker 0: So that leaves me to believe We have businesses out there That are not running a vulnerability management program Sadly until after they get breached?
• 37:23
  Speaker 0: We don't want that to happen which is why we do these webinars.
• 37:29
  Speaker 0: and in the case of recon Which Is what we discovered And was one Of The critical alerts sisa issued We see active exploitation in less than seventy-two hours after the patch was released.
• 37:46
  Speaker 0: Okay, The cautionary tale we don't want anyone to end up as a cautionary tail Here.
• 37:56
  Speaker 0: we have A large beverage manufacturing company that actually filed in court records, which you can do a search.
• 38:06
  Speaker 0: You can find the court records yourselves.
• 38:08
  Speaker 0: these snapshots on the left there are actual snapshots of the Court filings where the CEO was filing for bankruptcy protection due to an SAP security breach.
• 38:24
  Speaker 0: we don't want SAP going down during fashion week or holiday season You know, that can mess with client orders not being processed.
• 38:35
  Speaker 0: Financial reporting becomes impossible.
• 38:39
  Speaker 0: It's Not only an incident it becomes a brand crisis right?
• 38:44
  Speaker 0: It's going back to that relationship.
• 38:47
  Speaker 0: Fundamentally we want to maintain the integrity of That product of the brand and of the relationship Hundreds of companies compromised.
• 39:01
  Speaker 0: here is a brief little time when We've talked a little bit about this.
• 39:05
  Speaker 0: one thing.
• 39:06
  Speaker 0: I want to highlight and emphasize is that we were the only company on the planet That captured The actual attack.
• 39:17
  Speaker 0: so when we understood that this was happening?
• 39:21
  Speaker 0: um, we dove into that attack.
• 39:24
  Speaker 0: we reverse engineered it.
• 39:26
  Speaker 0: we understood there was a gadget chain involved.
• 39:31
  Speaker 0: We discovered that it wasn't only dropping of a web shell, but actually having payload.
• 39:39
  Speaker 0: you can run remote code execution.
• 39:41
  Speaker 0: Once we started to deconstruct this attack, we partnered very quickly and closely with SAP not just patching the other endpoints.
• 40:01
  Speaker 0: anyone who delivers a product doesn't understand what the root cause is, it can step into a whack-a-mole situation where an endpoint pops up that's being used to leverage the root Cause.
• 40:16
  Speaker 0: You close down at end point but then there are other Endpoints That Can Be Found.
• 40:21
  Speaker 0: So...that continues to address each and every endpoint as they're discovered But It Does Not Underline The Root Cause.
• 40:31
  Speaker 0: our work led to being able to understand the root cause for SAP and for SAP to issue the patch.
• 40:41
  Speaker 0: As a matter of fact, if you go to SAP's website and you look up the credits to researchers for twenty-twenty five big thank you in much love and gratitude to SAP for giving us wonderful shout out wonderful credit.
• 41:01
  Speaker 0: Epic three one, three two four zero day.
• 41:05
  Speaker 0: Love that we can work together.
• 41:09
  Speaker 0: timeline for this attack the Three One, Three Two Four.
• 41:12
  Speaker 0: so The initial probes were observed at the beginning of twenty-twenty five and when This first started to get announced the thought was That this Was a metadata uploader but from start To about August it was Observed as being used by China-based threat actors, as well as Russia based threat actors.
• 41:38
  Speaker 0: Very limited group and of course we had it but our goal was to make sure we understood it in worth with SAP to get it patched.
• 41:46
  Speaker 0: then Of course come August We see shiny hunters releasing it.
• 41:54
  Speaker 0: now As we see august fifteenth released on the shiny hunter's telegram by shiny shiny hunters they release the fully functional exploit.
• 42:08
  Speaker 0: It supports both modes, direct remote code execution as well as the web shell deployment and it also supported two latest versions of NetWeaver seven dot five in seven four .It does have a sophisticated post exploitation And it does make use of custom tooling very much targeted specific SAP assets.
• 42:35
  Speaker 0: so there's of deep understanding by these threat actors.
• 42:41
  Speaker 0: They know what they're doing and they know what their targeting, all that's been released publicly.
• 42:46
  Speaker 0: so when we talk about the chatter report in a big spectrum of attackers those script katies can take this to do heavy damage.
• 42:58
  Speaker 0: let's go into the exploit details.
• 43:01
  Speaker 0: I've got couple things here highlighted like why so serial?
• 43:04
  Speaker 0: That is de-serialization framework the attackers are using in their exploit.
• 43:12
  Speaker 0: Here's a snippet where they're looking at specific versions like seven point five, if it's seven point-five, it executes a certain line of code and then Of course we see at the end credits out to shiny hunters And you're making some comments in there too because that's what they do.
• 43:33
  Speaker 0: but That is an example of small little example of the exploit that was released by Shiny Hunters, that anyone can access.
• 43:44
  Speaker 0: Another cautionary tale... That exploit code we just looked at briefly?
• 43:49
  Speaker 0: Snippets!
• 43:51
  Speaker 0: Shiny Hunter's They're the ones who claim responsibility for attack and takedowns a global manufacturing company.
• 44:01
  Speaker 0: This attack was so far-reaching it drove GDP down into negative territory.
• 44:08
  Speaker 0: Tens of thousands employees were furloughed companies in the supply chain went out of business.
• 44:15
  Speaker 0: And as a matter fact, it has a long tail—it's still reverberating to today where I've met people that have their vehicles from this global manufacturing company and they're waiting for safety components which is mind-boggling!
• 44:35
  Speaker 0: It not only impacted all of these businesses in the global economy for the UK, but an impact it consumers even into April because they're still not getting their safety products or components that go into.
• 44:53
  Speaker 0: The thing that they have from this manufacturing company?
• 44:58
  Speaker 0: This is worst case scenario.
• 45:03
  Speaker 0: I've been asked can you show examples?
• 45:07
  Speaker 0: As well as the bankruptcy filing, these are the impacts that I can now talk about because they're very public.
• 45:15
  Speaker 0: It is gone out of the hands of these companies and i feel for them...I do!
• 45:19
  Speaker 0: I've been an incident responder.
• 45:21
  Speaker 0: it's tough.
• 45:22
  Speaker 0: you set aside time with family You set aside holidays And you are up online in late oil to try and understand what's happening.
• 45:31
  Speaker 0: So I feel for everybody there.
• 45:33
  Speaker 0: I Feel For Anybody Who Gets An Incident Especially A Big Breach.
• 45:39
  Speaker 0: The thing though is that we can use this as a poignant reminder.
• 45:45
  Speaker 0: That anyone can be targeted, no one is safe and there's things that we could do to prepare for it.
• 45:59
  Speaker 0: This is from Telegram Channel.
• 46:02
  Speaker 0: We look at Shodam A. Shodan is another security entity out here that provides information Information on IPs.
• 46:12
  Speaker 0: This was tied to an SAP portal out in Coventry.
• 46:21
  Speaker 0: And this is a snapshot of threat actor group that has logged into a business operation and it's showing information on one of the hosts within The Enterprise, we see a lot.
• 46:44
  Speaker 0: Let's get into the fundamental risks to luxury brand equity.
• 46:48
  Speaker 0: a lot of what this says is That things can happen, you know we.
• 46:58
  Speaker 0: it's all about the relationship.
• 47:00
  Speaker 0: It's about relationships internally where security practitioners take an objective view of the threat landscape.
• 47:09
  Speaker 0: You work with your architects, you work with Your Security Operations Center ,you Work With Your IT, you Work With Basis...You Work With The Business..You Understand What The Critical Points Are For Your Business....What are You Doing To Protect All Of That?
• 47:24
  Speaker 0: What Are You Doing to Monitor for all that?
• 47:26
  Speaker 0: Because If You Don't!
• 47:28
  Speaker 0: The Heists Can Happen Right?
• 47:30
  Speaker 0: You can Have Ghost Inventories For Counterfeiters Entering The Great Markets You can have pricing manipulation, you can have disruption during peak season.
• 47:40
  Speaker 0: Oh we don't want disruption during fashion week or holidays.
• 47:45
  Speaker 0: that can lead to tons of loss for revenue and lasting damage for partnerships.
• 47:55
  Speaker 0: Yeah I can say enough.
• 47:57
  Speaker 0: there's been a lot of lessons learned over twenty-twenty five by a lot.
• 48:04
  Speaker 0: the data has been breached.
• 48:05
  Speaker 0: We don't want ultra high net worth client registries breached, we wanna protect that privacy.
• 48:11
  Speaker 0: it's about that relationship.
• 48:18
  Speaker 0: Compliance myths.
• 48:21
  Speaker 0: there is being able to do the compliance check and then their security check right?
• 48:27
  Speaker 0: So you could potentially pass the compliance checks but doesn't make really ready for security audits.
• 48:38
  Speaker 0: It's important to understand that there is a distinction between the two because compliance checks says, okay you're doing things we need.
• 48:47
  Speaker 0: These are thresholds but never want to maintain them and go last mile in where threat actors reside That place they know have best chance of getting through systems.
• 49:06
  Speaker 0: that we want to make sure you are ready for real-time monitoring, that you have a continuous vulnerability management assessment program aided and informed by curated quality threat intel.
• 49:26
  Speaker 0: Please make sure your SAP is integrated into existing SOXs in incident response.
• 49:40
  Speaker 0: This is fantastic for content dev teams that work as security practitioners, this is fantastic.
• 49:47
  Speaker 0: For incident responders because we can start to map what these attacks look like through the MITRE attack framework.
• 49:58
  Speaker 0: so We could see here whether or through external third-party or employee That some of these TTPs are initial access valid accounts, default accounts or exploit public-facing applications.
• 50:11
  Speaker 0: Or it could be a spearfishing link or trusted relationship right?
• 50:15
  Speaker 0: It can also be a valid account but once that initial access is taken it could lead to privilege escalation.
• 50:23
  Speaker 0: we found a lot of vulnerabilities where thats possible.
• 50:26
  Speaker 0: We've stepped into environments ourselves and pen tested have been able successfully escalate privilege.
• 50:33
  Speaker 0: It's better to have us do it than an actual threat actor, because if its us we'll work with you To ensure You understand what the thread is in your environment and to get it protected.
• 50:46
  Speaker 0: Especially If you're not using an application that Is informed by our threat intelligence like onapsis platform And That can lead to exfiltration of data In the impact.
• 50:58
  Speaker 0: Yeah could be catastrophic.
• 51:03
  Speaker 0: I'll kind of go through these here a little bit quicker, but you can see with the little bit more detail about initial access and their descriptions.
• 51:13
  Speaker 0: This is something that you can absolutely verify on your own.
• 51:17
  Speaker 0: You could go to Mitre Attack, you could look up Initial Access ,you could look at The Techniques .You Could Look At The Descriptions.
• 51:29
  Speaker 0: Here's some for Prilogescalation Lateral Movement Persistence.
• 51:35
  Speaker 0: Let's take a look at persistence.
• 51:37
  Speaker 0: Once certain functionalities or authorizations have been achieved, attackers can create high-privileged users with well known powerful profiles such as SAP AWM.
• 51:49
  Speaker 0: Threats there!
• 51:54
  Speaker 0: Some more... some outcomes right?
• 51:56
  Speaker 0: The exfiltration the impact ransomware incidents can affect SAP applications and includes the encryption of SAP information.
• 52:04
  Speaker 0: And we see it.
• 52:06
  Speaker 0: We See It Happening Without V With Lock Bit.
• 52:11
  Speaker 0: We've seen the impact of financial theft.
• 52:14
  Speaker 0: There was a company that had that CVE from twenty ten be exploited and they lost millions Of dollars through payment systems, so it happens.
• 52:32
  Speaker 0: Okay Let's get to some additional information.
• 52:36
  Speaker 0: here we talk about challenges That do not go away in this shared responsibility model with rise.
• 52:45
  Speaker 0: There's components that SAP manages, the network, the infrastructure.
• 52:50
  Speaker 0: The operating system and database management.
• 52:53
  Speaker 0: yet there still a whole lot has to be owned by customers business data users configurations.
• 53:02
  Speaker 0: those are all important.
• 53:04
  Speaker 0: continue monitor.
• 53:05
  Speaker 0: please understand it is shared right share security model.
• 53:11
  Speaker 0: there's components that need to be handled by the customer.
• 53:14
  Speaker 0: Now, we have a fantastic quote from SAP CISO.
• 53:18
  Speaker 0: SAP delivers highly secure and compliant cloud infrastructure.
• 53:22
  Speaker 0: enabling customers to focus solely on securing their SAP applications and data going to rise means you still need to maintain SAP security.
• 53:38
  Speaker 0: We help streamline these areas of responsibilities under rise.
• 53:44
  Speaker 0: So you have access to me, it can reach out to me.
• 53:50
  Speaker 0: we could have follow-up meetings on anything he like.
• 53:54
  Speaker 0: our work or output goes right into an apps is platform.
• 53:58
  Speaker 0: so if you want to have the feeling and a certainty in the trust rate always back to trust.
• 54:06
  Speaker 0: do what.
• 54:06
  Speaker 0: I have the trust that we've got your back on apps as research labs in the lap of Onapsis platform.
• 54:14
  Speaker 0: It's like having Onapses research labs, researchers there with you on demand around-the-clock being able to assess your environment be able to defend your environment.
• 54:27
  Speaker 0: So that's really one of the big takeaways right?
• 54:32
  Speaker 0: You have to manage SAP security under rise and we can be partners too.
• 54:42
  Speaker 0: together SAP and Onapsis provide enhanced security for rise with SAP.
• 54:48
  Speaker 0: That continues the quote from Roland, SAP's global CISO for SAP Enterprise Cloud Services in Rise.
• 55:02
  Speaker 0: Oh big thing.
• 55:04
  Speaker 0: here we are The only SAP endorsed app on apps this platform.
• 55:16
  Speaker 0: that's a huge one.
• 55:17
  Speaker 0: We've put a lot of work and love an effort to be able get there and to earn SAP's trust.
• 55:24
  Speaker 0: We understand trust, we understand brand, we understanding
• 55:29
  Speaker 0: relationships.".
• 55:36
  Speaker 0: I mentioned control assesses in Defend.
• 55:38
  Speaker 0: Well actually didn't mention control blah!
• 55:40
  Speaker 0: I'm mentioning it now.
• 55:42
  Speaker 0: Control scans for code right?
• 55:46
  Speaker 0: It helps with DevSecOps.
• 55:48
  Speaker 0: Assess is your vulnerability management component.
• 55:54
  Speaker 0: So all of this comes together in a unified SAP application attack surface management.
• 56:00
  Speaker 0: It's powered again by the Onapsis Research Labs, your ace up your sleeve so to speak.
• 56:09
  Speaker 0: why?
• 56:09
  Speaker 0: This matters for our luxury conglomerate.
• 56:13
  Speaker 0: In a multi-maison visibility it provides a single platform view across SAP instances every brand Every region every deployment model under a unified attack surface Management.
• 56:27
  Speaker 0: It's powered by my team's threat intelligence.
• 56:30
  Speaker 0: Its real time and it feeds right into the platform.
• 56:34
  Speaker 0: we go back to that experience, too That relationship?
• 56:37
  Speaker 0: It protects it.
• 56:39
  Speaker 0: We're all about protecting.
• 56:40
  Speaker 0: you were all About protecting customers that use SAP And its secures your digital transformation as You move to rise or S for HANA Actions to take today.
• 56:56
  Speaker 0: know Your attack surface.
• 56:57
  Speaker 0: we've talked manage vulnerabilities with trusted and vetted threat intelligence, we've talked about that.
• 57:05
  Speaker 0: As well as integrate SAP into your security programs they're all important actions that you can take.
• 57:13
  Speaker 0: if You have already done so please give yourselves a round of applause.
• 57:16
  Speaker 0: I am proud to for doing it And i'm proud of you For being able To get this far With me in This journey Of relationships.
• 57:25
  Speaker 0: Please do yourself A favor And you know, thank you.
• 57:31
  Speaker 0: I appreciate for being here with me on this journey.
• 57:35
  Speaker 0: You can contact me anytime.
• 57:37
  Speaker 0: i Can be your partner.
• 57:39
  Speaker 0: Here's some helpful resources our github.
• 57:43
  Speaker 0: We have released open source tools For things like three one three two four in addition to the protection that we Have in napsis platform?
• 57:53
  Speaker 0: We have blogs you can look at or threat research and again i'm available.
• 57:58
  Speaker 0: You can find me on LinkedIn, Paul Ladansky.
• 58:02
  Speaker 0: You can reach out to me here at Onapsis.
• 58:04
  Speaker 0: I love what i do!
• 58:05
  Speaker 0: I Love our teams and I'd love a chance To be able to meet you And work with you.
• 58:13
  Speaker 0: Thank you
• 58:17
  Speaker 1: All right.
• 58:18
  Speaker 1: um thanks paul for those insights.
• 58:22
  Speaker 1: We've received several questions and I know there's A lot to unpack Here.
• 58:26
  Speaker 1: so let just go For one Right now and see because of we have the time constraints.
• 58:32
  Speaker 1: But Paul, somebody asked how do we convince our teams that monitoring is important if we've never been breached?
• 58:46
  Speaker 0: That's a really good question.
• 58:48
  Speaker 0: And that's the question I get all of time in prior threat briefings and my answer back then was you gotta trust us.
• 58:59
  Speaker 0: We have gone to incidents investigations and forensics.
• 59:10
  Speaker 0: It's hard to believe that SAP is gonna get targeted when people really didn't know about SAP outside of SAP, but twenty-twenty five changed everything.
• 59:23
  Speaker 0: SAP is now infiltrated by those well equipped, well understood very smart threat actor groups everything outside of SAP and now have a focus on SAP.
• 59:40
  Speaker 0: So especially in the luxury brand, it is so important brand to relationship that customer journey experience.
• 59:54
  Speaker 0: That best thing we can do for ourselves To demonstrate continued care And love For these relationships with brand and with customers, is to show that we still have the same verve.
• 1:00:08
  Speaker 0: That we apply that same verver...that we apply this passion as we do for our brand....that we use SAP.
• 1:00:20
  Speaker 0: Protecting SAP IS protecting the brand!
• 1:00:24
  Speaker 0: Protecting and monitoring making sure you understand what these attacks are when they're happening.
• 1:00:31
  Speaker 0: to make sure you understand what the vulnerabilities and the patches are when they get patched, to help you prioritize them.
• 1:00:39
  Speaker 0: That's applying the same zest-and-zeal that shows your commitment to the brand into the experience because SAP helps manage that brand.
• 1:00:51
  Speaker 0: so not managing SAP in a secure practice we've seen in twenty twenty five exposes companies a place where no one wants to be, and that's the cautionary tale.
• 1:01:04
  Speaker 0: So please my hope is you depart from this presentation knowing security practice in managing SAP is relationship practice.
• 1:01:21
  Speaker 0: it's brand protection management process.
• 1:01:27
  Speaker 0: more than saying oh there something going on over here?
• 1:01:33
  Speaker 0: We're protecting our brand.
• 1:01:35
  Speaker 0: We are protecting the customer journey and that means we absolutely have to protect some of the core foundational components for that, being SAP.
• 1:01:49
  Speaker 1: All right thanks Paul so much!
• 1:01:52
  Speaker 1: So...we had end on webinar today.
• 1:01:56
  Speaker 1: For any other questions in chat will be reaching out individually.
• 1:02:01
  Speaker 1: get those answered.
• 1:02:03
  Speaker 1: Also, just a brief reminder to everyone listening that this session has been recorded and the link of recording will be emailed.
• 1:02:11
  Speaker 1: And with that thanks again our speaker Paul for joining us in this briefing have.