Latest / Onapsis Podcast / Hacking & Defending SAP Live – Beyond the Perimeter: Managing the Expanded Attack Surface of SAP Cloud Migrations

Transcript

Hacking & Defending SAP Live – Beyond the Perimeter: Managing the Expanded Attack Surface of SAP Cloud Migrations · Onapsis Podcast

• 0:00
  Speaker 3: Good morning and welcome to part four of our Hacking in Defending SAP Applications webinar series, Beyond the Perimeter.
• 0:08
  Speaker 3: Managing the expanded attack surface of SAP Cloud Migrations.
• 0:12
  Speaker 3: My name is Leah And before I hand things over To our presenters i have some housekeeping notes.
• 0:17
  Speaker 3: First i want to point out The questions module within the on-twenty-four platform.
• 0:22
  Speaker 3: If you Have Questions please enter them at any Point during this presentation.
• 0:28
  Speaker 3: We will answer whatever questions we can at the end of the discussion.
• 0:32
  Speaker 3: You can always adjust the size with a media player on your end to make it bigger or smaller, depending upon preference.
• 0:38
  Speaker 3: There'll be video components for this webinar so you want ensure that the media player is large enough.
• 0:44
  Speaker 3: and finally please note there's being recorded in the link sent.
• 0:54
  Speaker 3: Part two, RQSO Lead Offense Security Researcher and Hector Espinoza Senior Sales Engineer.
• 1:01
  Speaker 3: This Onapsis team will discuss the Cloudverse on-prem transition to reveal how misconfigurations invisibility gaps can create security liabilities.
• 1:12
  Speaker 3: with that JP Can you start us off?
• 1:15
  Speaker 1: Absolutely thanks Leah.
• 1:17
  Speaker 1: Thanks everyone for joining us.
• 1:19
  Speaker 1: it's really exciting everyone on this yet another episode of these docu-series.
• 1:27
  Speaker 1: We have a lot of content and great demos that we're going to be showing you, so let's kick this off!
• 1:36
  Speaker 1: Today's agenda is focusing around the expanded attack surface it's beyond the perimeter right?
• 1:46
  Speaker 1: So now We're going to get into the details of why.
• 1:51
  Speaker 1: today, leveraging the latest and the greatest technology from SAP introduces significant complexity in our landscapes.
• 2:03
  Speaker 1: And we need to be able understand that complexity so you can secure it.
• 2:08
  Speaker 1: So I'm gonna do an intro.
• 2:10
  Speaker 1: go through The attack demos on then were gonna wrap up with some recommendations how you can address this complexity through automation and controls.
• 2:27
  Speaker 1: About us, the speakers.
• 2:29
  Speaker 1: I'm going to let each one of you introduce yourself.
• 2:34
  Speaker 1: I'll start since I am already speaking.
• 2:36
  Speaker 1: JP, Leah provided a brief intro.
• 2:41
  Speaker 1: CTO on One of the founders of Onapsis working very closely with our research team ensuring that our customers get the best possible visibility and protection from the latest threats that threat actors are executing, driving through their attacks.
• 2:59
  Speaker 1: Part two do you want to continue?
• 3:04
  Speaker 0: Thank You!
• 3:04
  Speaker 0: Hello everybody my name is Pablo Artuso.
• 3:06
  Speaker 0: I've been working as a security researcher currently as tech lead of team for the last twelve years.
• 3:12
  Speaker 0: our, yeah.
• 3:13
  Speaker 0: Our main work from this team is to conduct vulnerability research find surveys on the pentest and also involving threat intelligence parts of.
• 3:23
  Speaker 0: I think JV will speak a little bit more about them but happy to be here once more so Hector?
• 3:31
  Speaker 2: Sure hi everyone.
• 3:33
  Speaker 2: my name is Hector Spinoza And i'm a senior self-signature.
• 3:36
  Speaker 2: I've been with Onapsis for almost twelve years now part of, you know the technical team and
• 3:44
  Speaker 1: then
• 3:45
  Speaker 2: they're self-steam now.
• 3:47
  Speaker 2: You are pretty familiar with the solution in their company And today I have the opportunity to give another presentation about the NAPI Solution and happy to be here Thank you If you want to
• 4:00
  Speaker 0: continue.
• 4:01
  Speaker 1: Absolutely thankyou Hector!
• 4:04
  Speaker 1: As you guys were introducing yourselves tenure here in the presenting team.
• 4:12
  Speaker 1: So there's a lot of experience and living through securing SAP customers amongst these three speakers, so happy to be part of this team.
• 4:24
  Speaker 1: All right!
• 4:26
  Speaker 1: What is the attacking or hacking and defending SAP applications like .series?
• 4:33
  Speaker 1: We started this specifically this year because urgent need by defenders to really understand the threat landscape, what threat actors do and be able to understand those attacks in order to secure their own systems from these attacks.
• 4:56
  Speaker 1: The threat landscape has been evolving and significantly increased specifically this year driven specifically driven by AI, right?
• 5:10
  Speaker 1: The generative models allow for an unprecedented acceleration of the threat landscape.
• 5:18
  Speaker 1: The capabilities of threat actors and we as defenders need to have as many tools and as many capabilities on knowledge—as much knowledge as possible —to be able to secure our systems.
• 5:36
  Speaker 1: So that's a whole goal of this doki series.
• 5:40
  Speaker 1: We want to
• 5:41
  Speaker 3: share
• 5:41
  Speaker 1: our learnings, we wanna share what we see threat actors doing.
• 5:47
  Speaker 1: so you on the other side as defenders can really leverage all these learnings and secure your systems which is shared goals right?
• 5:59
  Speaker 1: To secure SAP landscapes across the globe.
• 6:06
  Speaker 1: Both part two and myself are active members of the UNAXIS research labs with different capacities, different levels of involvement but we're working towards identifying threats.
• 6:20
  Speaker 1: Identifying the different elements that threat actors use when they target SAP applications.
• 6:31
  Speaker 1: how to protect SAP systems from those attacks, right?
• 6:39
  Speaker 1: So we have a large backlog of vulnerabilities that we have reported to SAP and other ERP vendors over time.
• 6:53
  Speaker 1: We basically leverage that knowledge leverage the reports that the Onaxis Research Labs performs to ERP vendors and specifically SAP, and compare their knowledge into content capabilities for the Onaxis platform.
• 7:20
  Speaker 1: So effectively periodically all of our customers are empowered with more visibility or capabilities through different specific capabilities of the Anapsis platform.
• 7:35
  Speaker 1: But also, something that I'm very proud off this Anapsist Research Labs team is we periodically report vulnerabilities to SAP and those vulnerabilities eventually materialize in security patches benefiting all SAP customers making SAP applications more secure across the globe.
• 7:57
  Speaker 1: so thats another shared objective when we talk about what we do is also not only our customers benefit from the output and knowledge of the analysis research labs, but effectively all customers too.
• 8:17
  Speaker 1: All right let's get into this specific topic today which is beyond a traditional perimeter And will be talking about the traditional perimeter if you go a couple of years back in time.
• 8:31
  Speaker 1: If some of you are long-time SAP users, SAP bases... You may be familiar with some of these right?
• 8:41
  Speaker 1: Some years ago it maybe true that SAP landscapes were something like this Of course oversimplifying but we had different SAP applications different products across landscapes with different tiers.
• 9:04
  Speaker 1: Some of these are most of this interconnected, but the common denominator across all of these systems was that these were beyond the firewall right?
• 9:15
  Speaker 1: So some of these applications we're internet facing in some cases But for the most part organizations where keeping applications beyond the firewall, not exposing them.
• 9:30
  Speaker 1: And that gave some sense of security to organizations because in some cases they were saying you know what?
• 9:41
  Speaker 1: We are behind
• 9:42
  Speaker 0: our corporate firewall.
• 9:44
  Speaker 1: we share the same protections at all other applications and while could have been true to some extent on some of those controls, this has evolved significantly over time.
• 10:01
  Speaker 1: Leveraging the capabilities and their technology that SAP was developing or acquiring in some cases adjusting to the latest trends and the latest innovations in IT such as cloud and expanding the attack surface while doing this significantly because now we are no longer running applications, business applications in our on-premise systems.
• 10:32
  Speaker 1: In our own premises behind the firewalls.
• 10:36
  Speaker 1: Now This also is a simplification of what today's landscapes looks like but it gives you an idea how much why there this footprint of different technologies really is.
• 10:53
  Speaker 1: because now we have the on-premises systems.
• 10:56
  Speaker 1: We may have private cloud, these on premises are mixing for most part of data centers and their own companies.
• 11:05
  Speaker 1: also some systems in AWS assure GCP depending on the provider's choice.
• 11:13
  Speaker 1: you will be running your system across different providers but also you may have parts of your landscapes in rice managed by SAP with a shared responsibility model.
• 11:27
  Speaker 0: Also,
• 11:28
  Speaker 1: most likely the majority of you already have BTP connected with on-premise systems through some cloud connector and also running public Cloud apps such as SuccessFactors, Arriva, Concure and many others.
• 11:47
  Speaker 1: So SAP has been expanding its portfolio of SaaS applications, in some cases using well-known SAP technology like UI five and application space on HANA or net weaver.
• 12:06
  Speaker 1: But other cases this is completely different technology, completely different concepts from a security perspective so it really increases the complexity and the footprint of different technologies.
• 12:21
  Speaker 1: So guess what?
• 12:23
  Speaker 1: This extended landscape, on this extended set of technologies also expands the attack surface And we need to understand that any attack in any of these elements could potentially imply further compromise across the rest Of the IT landscape of SAP applications.
• 12:44
  Speaker 1: And those are the examples that we're going to be looking at and that were gonna be covering today.
• 12:51
  Speaker 1: Just a wrap up on this introduction, they building blocks.
• 12:56
  Speaker 1: these are just some examples.
• 12:57
  Speaker 1: but as I mentioned on-premises cloud connectors BTP SAP rise or managed cloud applications also SAS applications many others potentially all of these interconnected And this is true for the majority of SAP customers today, right?
• 13:20
  Speaker 1: So five years ago it may be through that.
• 13:26
  Speaker 1: The majority were more on the on-prem slash private cloud but today that's shifting significantly because of SAPs
• 13:37
  Speaker 2: own push
• 13:38
  Speaker 1: off customers towards rise and really leveraging the latest products, and the latest innovations from SAP which are deployed within the cloud.
• 13:52
  Speaker 1: So we're going to be looking at specific attack scenarios as I mentioned actually three of them.
• 14:02
  Speaker 1: they involve these extended attack surface which is... We have on-premises systems BTP as an example of cloud application, and then we have Cloud Connector which basically connects both of them.
• 14:23
  Speaker 1: What I mentioned is hey depending on how the attacker is positioned in this technology landscape.
• 14:32
  Speaker 1: attackers could potentially move back-and forth across different elements.
• 14:37
  Speaker 1: so an example of how an attacker could potentially compromise and SAP Cloud Connector.
• 14:45
  Speaker 1: And from that system, jump into on-premise SAP application will also show someone compromising a non-premises SAP application by leveraging the existing connections.
• 15:00
  Speaker 1: who would enjoy jumping to BTP?
• 15:03
  Speaker 1: The other way we'll A compromise on a BTP application could be used to compromise on-premise applications, and the other direction.
• 15:18
  Speaker 1: Why is this important?
• 15:20
  Speaker 1: Because in the past we may believe that level of controls were sufficient to protect our SAP applications even if it's still arguable because you cannot rely on a firewall applications as complex SAP, as interconnected as SAP and critical as SAP applications.
• 15:45
  Speaker 1: But now even that is challenged.
• 15:48
  Speaker 1: today because we have way more complexity with more interconnectivity between different technologies it's important to understand potential security gaps across any of these layers could introduce risk across the entire landscape.
• 16:10
  Speaker 1: So with that, I'm going to
• 16:12
  Speaker 0: pass it over
• 16:12
  Speaker 1: to Part two.
• 16:14
  Speaker 1: who's gonna run you through the first demo?
• 16:19
  Speaker 0: Thank You JP!
• 16:22
  Speaker 0: So let's start speaking about what this demo is all about.
• 16:26
  Speaker 0: so as JP introduced The First one is how an attacker was able to somehow compromise.
• 16:34
  Speaker 0: a cloud connector Is able to jump on a prem system and potentially also compromising where to thread information.
• 16:42
  Speaker 0: Before starting that, I would like you share this architecture.
• 16:44
  Speaker 0: we're gonna go back to these in the future as well.
• 16:49
  Speaker 0: however i'm not going to focus on all of these parts and then focus just from the relevant part for this demo which is let's say The Orange Branch.
• 16:57
  Speaker 0: So On the left side of the slide You can see a sub-BTP account, subaccount sorry And basically an HR portal application Which Is running on the BTP site That Following the orange flow, this is connecting or pulling data from an on-prem system which is a human resources system.
• 17:17
  Speaker 0: Or run in a human resource model
• 17:20
  Speaker 1: and In
• 17:20
  Speaker 0: order to make that connection it has to go through the cloud connector.
• 17:23
  Speaker 0: right because again Those open-prem systems are not just exposed our chassis both through virtual holes inside of Cloud Connector.
• 17:31
  Speaker 0: So with these architecture in mind let's see how the VTP configuration is done.
• 17:37
  Speaker 0: so Here you can see the destination name that was set up in the BTP side pointing to a virtual host, which is in this case HCM.prod.
• 17:47
  Speaker 0: This is not really a host of system it's just a virtual hosts exposed by account connector.
• 17:52
  Speaker 0: and finally we can see there That There Is A User And The Password Stored In This BTP Destination.
• 18:00
  Speaker 0: Please Remember That Username Because We Are Going To Use It
• 18:02
  Speaker 1: Afterwards.
• 18:05
  Speaker 0: Thinking on the cloud connector side of configuration, what we have here is well the mapping as I was telling you right from virtual host which is part exposed to the internal hosts.
• 18:15
  Speaker 0: Which are real internal hosts in the on-prem system that once more not expose to the BTP site just a new virtual host being exposed.
• 18:26
  Speaker 2: so
• 18:26
  Speaker 1: also
• 18:27
  Speaker 0: JB said he had select and specific attack to show you and for today we selected a very weird trace that could be configured.
• 18:38
  Speaker 0: This race is called the Tuned Traffic Trace, according to SAP documentation once it's enabled have to be careful because sensitive data would specifically passwords user names even credit card numbers could be stored over there.
• 18:57
  Speaker 0: So, the demonstration that we have today would be which are the consequences of enabling this trace in your systems.
• 19:08
  Speaker 2: And how
• 19:08
  Speaker 0: were you going to show these?
• 19:09
  Speaker 0: The
• 19:09
  Speaker 3: vector for attack
• 19:10
  Speaker 0: will be following We assume that attacker has access to cloud connector with a support role Which means it has access read but not modify traces and without user It will end up or the target will end compromising HR system running on-prem.
• 19:30
  Speaker 0: So for this, we have a demo.
• 19:34
  Speaker 0: On the first part of the demo you're going to see a black screen.
• 19:36
  Speaker 0: This is the screen of the administrator.
• 19:38
  Speaker 0: It's actually not relevant For the attack but it's part Of that demonstrating how To enable these traits.
• 19:45
  Speaker 0: so here We can see How there Is uh this part of The configuration where You Can See the checkbox
• 19:51
  Speaker 1: down
• 19:51
  Speaker 0: There That once is checked
• 19:54
  Speaker 1: They are
• 19:54
  Speaker 0: Going to appear new files over there.
• 19:56
  Speaker 0: Now let's sum to the display of the attacker, the monitor user.
• 20:01
  Speaker 0: So we see those files over there and they are able to be read.
• 20:06
  Speaker 0: The monitor is able to read a traffic that it's going through the application To the HR system right?
• 20:12
  Speaker 0: so here you can see not only the password A user encoding B-SYC for but also the URL.
• 20:19
  Speaker 0: It's pretty easy For
• 20:20
  Speaker 1: an attacker
• 20:21
  Speaker 0: to decode this b-sysc for And get their real credentials That are used in the ptp destination.
• 20:27
  Speaker 0: After this, the attacker can do or is going to two different commands.
• 20:31
  Speaker 0: just take connectivity against the HR system that's running on-prem.
• 20:39
  Speaker 0: The first one will result in a photo one because no credentials were provided and
• 20:43
  Speaker 1: then last one.
• 20:45
  Speaker 0: luckily for the attacker it'll be resulting at two hundred because the credentials are valid.
• 20:50
  Speaker 0: so now the attacker does several things to test these credentials.
• 20:54
  Speaker 0: For instance, it could go to SAP doing and try to log into the system.
• 20:57
  Speaker 0: Unfortunately for the attacker this is not a valid user.
• 21:01
  Speaker 0: However you can use other ICF services... ...for instance the very well-known SoftRFC which is pretty dangerous.
• 21:08
  Speaker 0: Here we can see that the attacker realizes that he's activated.
• 21:11
  Speaker 0: So by using crafted script The attacker will create new users in the system with potentially very high privileges.
• 21:23
  Speaker 0: In this case, we'll try to use ACPO.
• 21:24
  Speaker 0: This could work or not depending on the authorizations of all end credentials but as you can see here it worked.
• 21:32
  Speaker 1: so now
• 21:33
  Speaker 0: the attacker can log in with a new created user using SAP GUI and just for the sake of this demonstration.
• 21:40
  Speaker 0: um It would show uh that the credentials uh sorry the authorisations obtained were actually acp.
• 21:51
  Speaker 0: So going back to the slides, how can we be secure against these actions that happened?
• 22:00
  Speaker 0: The first recommendation would be to properly configure the traces.
• 22:03
  Speaker 0: This let's say dangerous trace called a tunnel traffic trace which is documented by SAP and we are sharing links in not only previous slide but also final references like where it is basically say to be careful how to activate this.
• 22:20
  Speaker 0: and if highlights these four eyes principle, two deal with this topic.
• 22:25
  Speaker 0: A second thing that maybe's not that clear.
• 22:28
  Speaker 0: Is that?
• 22:29
  Speaker 0: If you realize the attackers told credentials That were meant to be used by a nature system an HR application But we those credentials.
• 22:38
  Speaker 0: It was able to create a new user on the ACP system.
• 22:42
  Speaker 0: so It is very important that every time you configure a VTB destination, the user that you are using there it's a scope to only be actions required for that application.
• 22:56
  Speaker 0: So most likely HR portal shouldn't have access of their possibility and create users with ACBO authorizations.
• 23:08
  Speaker 0: And finally, the final part of the attack was using an ICF service that is called SOAPRFC which is pretty well known and we all know it's very dangerous.
• 23:17
  Speaker 0: So the question is should that ICS service be running?
• 23:22
  Speaker 0: If its possible to deactivate then biggest recommendation would be do it.
• 23:28
  Speaker 0: if its not possible because there are some needs for market to run
• 23:34
  Speaker 1: it than
• 23:35
  Speaker 0: best way to operate with it would be to restrict the access, specifically this one and two other sensitive ICF services.
• 23:47
  Speaker 0: I think that was all.
• 23:47
  Speaker 0: now we'll hand out again back to JP for a second demo.
• 23:52
  Speaker 1: Sounds great.
• 23:53
  Speaker 1: Thank you Bartu For these first demos.
• 23:57
  Speaker 1: Now were gonna show The second attack scenario which is on-premise to cloud.
• 24:03
  Speaker 1: As i was saying We are talking about an On-premises system.
• 24:08
  Speaker 1: in this case This could be an Sforhana, for example.
• 24:12
  Speaker 1: It can be any type of ABAP-based solution and this system is configured with a destination pointing to a cloud application.
• 24:24
  Speaker 1: in these case the cloud applications that we are using for demo it's an ABAP on BTP but as just one example they could be something completely different.
• 24:37
  Speaker 1: The idea that these integrations
• 24:40
  Speaker 2: should be
• 24:41
  Speaker 1: defined with the specific concept of least privilege, right?
• 24:48
  Speaker 1: If there is
• 24:49
  Speaker 0: a set
• 24:50
  Speaker 1: of credentials and authentication already in place stored on the destination it should only assign the privileges required for that specific integration or use case.
• 25:05
  Speaker 1: In this case The user on the target system, on the ABAP on BTP has
• 25:12
  Speaker 2: two
• 25:13
  Speaker 1: communication arrangements.
• 25:14
  Speaker 1: This is a communication user with very specific set of assignments.
• 25:21
  Speaker 1: One is a communications arrangement for the purpose what this integration was built in and another one that wasn't specifically needed.
• 25:35
  Speaker 1: This could be a drift in the configuration, testing further leaked into production or different reasons.
• 25:46
  Speaker 1: With that what's going to happen is this S-for-HANA system
• 25:51
  Speaker 0: through
• 25:52
  Speaker 1: the integration with ABAP on BTP system will have specific authorizations are gonna be abused by someone who was able to compromise that.
• 26:03
  Speaker 1: on-premise systems All right, so let's jump into the demo itself.
• 26:10
  Speaker 1: Now
• 26:11
  Speaker 0: the demo.
• 26:12
  Speaker 1: I said that it is an Sfor system So its a system running either on private cloud or on-premises.
• 26:22
  Speaker 1: Going through SM-Fifty-Nine we can see the existing integration with Ava.com BTP We tested and its working.
• 26:31
  Speaker 1: Its pointing to specific intent of Ava.BTP and this has, there is a specific report that can be executed that shows us the connectivity some exchange of information with the remote system.
• 26:52
  Speaker 1: but then these attackers that compromise on-premise systems because thats an overall objective right showing that a compromise in one system could impact the rest of the systems.
• 27:06
  Speaker 1: In this case, these attacker is creating a specific report custom code that can be used to do different things.
• 27:15
  Speaker 1: we'll see what it's being done.
• 27:17
  Speaker 1: but because he realized there was an established trust relationship through his destination so is basically using this destination.
• 27:33
  Speaker 1: So these attackers listing the communication users first through this communication arrangement that was configured, then he's using the same communication arrangement to create another communication user and also through this same code it's called a could be doing anything, but in this case it's using the right APIs to connect with ABAP on BTP is creating also a business user and widening the privileges of that business user.
• 28:13
  Speaker 1: So through these integration they attacker was able actually get a whole foothold into their ABAP-on-BTP system as well as a business user.
• 28:29
  Speaker 1: And then now we go and list the users, Now We see this backdoor user that was created right?
• 28:35
  Speaker 1: This is just for the purpose of the demo.
• 28:37
  Speaker 1: um other things could be executed depending on their privileges, Depending On The Code That Is Deployed.
• 28:47
  Speaker 1: They Previse On Both The Target And The Source System And We Can See The Created Communication User There basically highlighting the compromise on the target system.
• 29:00
  Speaker 1: All right, so this was basically showing how these attack of on-premise systems could impact into a cloud system.
• 29:15
  Speaker 1: in this case again we're talking about an ABAP on BTP, there's going to be a BTPS account and other such solution.
• 29:23
  Speaker 1: The concept is same as a pre established integration with pre-established privileges, so what those privileges allow that user to do is very important and it should be further restricted.
• 29:39
  Speaker 1: So recommendations don't reuse passwords for specific destinations if possible don't store them on the credentials, use other type of authentication mechanisms.
• 29:56
  Speaker 1: Use principle propagation if possible, certificates more secure authentication mechanisms and also make sure that you secure both the privileges of.
• 30:10
  Speaker 1: the user is connecting into a target system but it's possible to restrict who can use these destinations as well.
• 30:20
  Speaker 1: So it's all a matter of privileges and really doing defense in depth, right?
• 30:25
  Speaker 1: Making sure that the more you restrict the elements of this integration.
• 30:32
  Speaker 1: The more layers of security we are introducing with that.
• 30:37
  Speaker 1: I'll pass over to part two for their third demo.
• 30:43
  Speaker 0: thank you JP.
• 30:44
  Speaker 0: okay let's go to compromise application that is running on the cloud and demonstrate how to jump into an on-prem system.
• 30:59
  Speaker 0: So here's back again, they're architecture.
• 31:01
  Speaker 0: in this case I will try to explain a full architecture.
• 31:04
  Speaker 0: we already explained there orange branch.
• 31:08
  Speaker 0: The green branch is more or less the same.
• 31:09
  Speaker 0: it's different application In this case called supply
• 31:12
  Speaker 1: portal
• 31:13
  Speaker 0: and its simple application getting data vendor data let say from an on prem system running Sfor.
• 31:20
  Speaker 0: In the middle, we have a CloudConnector destination configure that is one used.
• 31:25
  Speaker 0: But if you properly see this there's no...
• 31:31
  Speaker 2: The orange
• 31:31
  Speaker 0: flow and green flow looks pretty independent right?
• 31:34
  Speaker 0: There are no cross connection between them.
• 31:37
  Speaker 0: so let us think about it.
• 31:39
  Speaker 0: And also to share services, the destination service on connectivity service These two important services always running in BTP in a sub-account if you are using CloudConnector, for instance.
• 31:51
  Speaker 0: Because in order to create destinations You have to make use of these two services.
• 31:55
  Speaker 0: The destination service is the service that allows you to create designations
• 31:59
  Speaker 1: and
• 31:59
  Speaker 0: the connectivity service Is like kind an internal proxy That allows you actually route traffic And move through different layers In this case Through BTP To the cloud connector.
• 32:11
  Speaker 0: So let's see how this is reflected from the BTP connection side.
• 32:19
  Speaker 0: So, in this setup we already see these for HR Prod.
• 32:22
  Speaker 0: on the Super Prod you can look that is pretty similar or there's a different user because it has a different system as well and also with password which is stored over here.
• 32:35
  Speaker 0: From the cloud connector side We have the same as before mapping between the referral and turn host And afterwards, we have the different which is called the access control.
• 32:44
  Speaker 0: This is a very important screen because he actually here configured with our dn points that are allowed to be reached
• 32:51
  Speaker 1: through the
• 32:51
  Speaker 0: cloud connector for each system there is behind the Cloud Connector right?
• 32:55
  Speaker 0: So this Is A Very Important Screen To Perform Configurations.
• 33:01
  Speaker 0: Finally Here Yeah We Have The Let's Say The Connection Between The BTP Destination On The Cloud Connectors Configuration Where You Can See The Mapping Between The URL and build a host.
• 33:14
  Speaker 0: So how the attacker will look like, basically
• 33:18
  Speaker 2: an attacker.
• 33:19
  Speaker 0: we're going to assume this and attack her which is have access to the supplier portal.
• 33:23
  Speaker 1: A vulnerable
• 33:24
  Speaker 0: application.
• 33:25
  Speaker 0: it's gonna finally end up compromising DHR system Which again not connected at all because they two flows are pretty
• 33:33
  Speaker 1: bad ones.
• 33:35
  Speaker 1: so
• 33:36
  Speaker 0: let's sum to video.
• 33:37
  Speaker 0: Let's see How This Actually Works?
• 33:44
  Speaker 0: At first you're Gonna See The Screen of supplier portal application.
• 33:49
  Speaker 0: This is not very relevant to see what happens actually, but it's important that you recognize there is a vulnerability shown by the attacker now and also for this symbol because that screen is short or pretty small we can use directly the API as seen in a moment.
• 34:18
  Speaker 0: So in Cloud Foundry, there is this big app service which holds all the credentials that actual applications need to connect with the destination and the connectivity.
• 34:28
  Speaker 0: As you can see here
• 34:29
  Speaker 1: right?
• 34:31
  Speaker 0: In JSON format All of these information are stored on the OS.
• 34:35
  Speaker 0: so With this information a person or attacker who has access to it can craft tokens And use these services The Destination and the Co-Activity Service and dumping all the destinations with information that is in the shared service, here you'll see HR Prod and a supplier Prod.
• 34:57
  Speaker 0: With plain text passwords this is possible but it's not by default like this.
• 35:02
  Speaker 0: so now having these information we can use connectivity decision
• 35:08
  Speaker 2: right?
• 35:10
  Speaker 0: And try to grab and reach the system.
• 35:15
  Speaker 0: behind CloudConnect The quality service goes through an internal proxy as I told you.
• 35:21
  Speaker 0: So the only way to reach it is using a remote code execution, right?
• 35:30
  Speaker 0: So that's how what we did there first was try and see if it's reachable in this system And now what its gonna do Is try to dump all information That is exposed into HR System like If It Was Using The Other Application The HR Portal Application.
• 35:47
  Speaker 0: Here is a nicer way to see this information leaked, where you can see for instance the monthly income of each person or their company employee and even numbers.
• 36:02
  Speaker 0: So what happened here?
• 36:03
  Speaker 0: How do we protect it about these?
• 36:05
  Speaker 0: Well first of all It all started because vulnerable application.
• 36:10
  Speaker 0: so the first recommendation will be try to scan your code with static analyzers trying to identify vulnerabilities.
• 36:16
  Speaker 0: in this case was remote execution but other kind could also be abused.
• 36:23
  Speaker 0: The second and very important thing to have in mind is that spaces and organizations are not security boundaries, right?
• 36:31
  Speaker 0: So it's important to understand the shared services between sub-accounts as a kind of shared because of applications who have their own credentials but they're going to connect into same service.
• 36:43
  Speaker 0: once connected you can see all those parts of these two accounts.
• 36:47
  Speaker 0: Finally I said it's very important not to store all credentials, but use also principle propagation because in this case that would avoid the attack to happen.
• 37:00
  Speaker 0: And finally as I was telling you before these cloud connectors three where you configure a resource path is called the access control list... ...is very important and In this case he wasn't abused But its' very important for understanding if
• 37:14
  Speaker 0: e.g.,
• 37:15
  Speaker 0: that will have had the slash Let's say a path, it would allow the attacker to do same attack that he did in the attack number one.
• 37:25
  Speaker 0: In the demo number like rating an USB user.
• 37:30
  Speaker 1: So
• 37:31
  Speaker 0: I think there was all and i think its time now to shout out to the defense side of this presentation And for that I will hand out their presentation to Hector.
• 37:41
  Speaker 2: Perfect, perfect Pablo.
• 37:42
  Speaker 2: thank you so much.
• 37:44
  Speaker 2: Thank you JP For giving us these presentations about this demo, the live demo execution.
• 37:51
  Speaker 2: One thing it's really important for us as a customers and SAP users is to understand that
• 37:58
  Speaker 1: they are
• 37:59
  Speaker 2: bad actors trying to attack SAP systems in try take any advantage from their way you configure your SAP system or the way your current SAP system has been used etc.
• 38:15
  Speaker 2: So I'm going to share my screen right now, you can see my screen.
• 38:22
  Speaker 2: Now that we know these bad actors are basically attacking SAP system regardless of their locations We also need help.
• 38:33
  Speaker 2: at the end of day SAP is gonna help tremendously providing a lot information regarding SAP issues But also, you need to have that extra set of eyes and not that extra solution.
• 38:48
  Speaker 2: That it's gonna provide information for you to understand where do you need put your security measures to protect a SAP system?
• 38:57
  Speaker 2: For that I wanted introduce the Trade Intel Center which is basically JPEG team in.
• 39:04
  Speaker 2: Pablo's team will use this specific page of the Naples Solution to provide communications about the latest and greatest states that they see in their world, right?
• 39:17
  Speaker 2: For SAP products.
• 39:20
  Speaker 2: So yesterday we gave you an idea from last week.
• 39:23
  Speaker 2: there was a new known public exploit that I was attacking or those focusing on specific vulnerability And this is the type of information that on apps it's going to provide weekly two SAP customers.
• 39:41
  Speaker 2: but also thinking about how you can protect your SAP environments, regardless of locations and regardless all the attacks.
• 39:49
  Speaker 2: About the latest and greatest strength?
• 39:50
  Speaker 2: How do we know...how don't we do
• 39:52
  Speaker 2: that?".
• 39:53
  Speaker 2: And part of information that SAP is going to release it's gonna help you tremendously in the sleeper.
• 39:57
  Speaker 2: Also You need to have another set of eyes with a set of knowledge That will provide the right and perfect information for you to protect SAP systems.
• 40:09
  Speaker 2: So imagine from last year We have this big, three one.
• 40:13
  Speaker 2: Three two four... This big vulnerability that was affecting every Java system they were.
• 40:22
  Speaker 2: we saw a lot of companies being breached and actually there's this huge company automotive company that was breached through the specific vulnerability And you know Through that specific attack A lot of components didn't know it exists but also they didn't have an easy way to understand what was that type of scenario?
• 40:45
  Speaker 2: What is the type of exploitation process.
• 40:48
  Speaker 2: So on Apsis Weekly, we released these types reports and information for our customers where you can see this specific issue about.
• 40:59
  Speaker 2: it doesn't matter if your system has some premise like an ECC system on BTP or it doesn't matter if is in cloud to like a, I don't know.
• 41:10
  Speaker 2: Like a sub rise type of environment.
• 41:13
  Speaker 2: Or NAPSIS has gathered all that information and its going put into the way that its readable for you And also you can understand what's currently happening but Also an easy way To see If your system might affect.
• 41:24
  Speaker 2: You Can See here In this example That our NAPSSIS telling us This Is Our demo Environment But It's also Telling Us Like This Java System Is Already Affected By That Vulnerability.
• 41:35
  Speaker 2: Also, we are providing information about what could be the worst outcome if you don't do anything regarding that issue.
• 41:43
  Speaker 2: And also the technical solution in this case is by applying a specific SAP note But just imagine it's at zero day train.
• 41:52
  Speaker 2: This something that SAP still hasn't released a patch
• 41:56
  Speaker 1: or
• 41:57
  Speaker 2: a fix for this bunality.
• 41:59
  Speaker 2: Fifty-five percent of the hot and critical news release last year by SAP through the regular patch Tuesday, they came from our research lab.
• 42:11
  Speaker 2: This is providing information about how powerful and knowledgeable it's our ONAPSYS Research Lab And this makes us special in different than any other competitor on the market.
• 42:25
  Speaker 2: Also for the ONAPPSYSSES product we can see that I have this huge report with all the vulnerabilities that are currently in my SAP landscape, and my SAP environment.
• 42:41
  Speaker 2: And regardless of where your SAP systems are located for example i'm going to go grab an SAP ABAP system a BTP web dispatcher cloud connector on S or HANA system or a HANA database .I can filter All those reports or those type of systems.
• 43:03
  Speaker 2: Also, if you can see some of these vulnerabilities are going to be disclosed for the first time by the synopsis research team and also they're gonna provide a way four customers for this specific zero-day threats to identify If They Are Affected through a test case that we'll release continuously on our synopses customer.
• 43:28
  Speaker 2: but also one thing that we always like to, or kind of put a little bit more effort is for the vulnerabilities are basically critical in our environment.
• 43:40
  Speaker 2: That we know they exist and their affecting our environment.
• 43:44
  Speaker 2: on apps it's also providing compensating controls.
• 43:47
  Speaker 2: so we have a threat monitoring capability where can build with matter-of-one click that it's going to monitor, is gonna help us monitor this specific issue for real time attacks.
• 44:04
  Speaker 2: So from the assessment point on up just when I be able to identify if we're affected front of different standpoint or not this one identified If someone is trying to take advantage off any of those vulnerabilities to this issue or not just again, it's going provide in-depth information about that issues.
• 44:28
  Speaker 2: It is gonna tell us where your environment that specific vulnerability is identified but also its gonna provide the necessary information for security teams to protect their SAP system.
• 44:42
  Speaker 2: Remember as a security team
• 44:44
  Speaker 0: normally
• 44:45
  Speaker 2: they don't have the SAP knowledge.
• 44:47
  Speaker 2: They dont' have SAP access to protect those environments, but at the end of day they are the ones responsible for maintaining an SAP system secure.
• 45:01
  Speaker 2: So what if we provide all that type of information?
• 45:04
  Speaker 2: For them to understand why it's happening?
• 45:07
  Speaker 2: okay What could be the worst outcome If you don't do anything regardless that specific vulnerability?
• 45:13
  Speaker 2: But also We're going to provide a technical solution step-by-step remediation So they can understand, okay these are the changes that need to happen in my environment.
• 45:23
  Speaker 2: To protect against specific vulnerability that was discovered through their on-app access assessment.
• 45:30
  Speaker 2: Also you will see an external reference.
• 45:33
  Speaker 2: More information about SAP notes that SAP released regarding this specific issue.
• 45:38
  Speaker 2: Sometimes we even put information from blogs and SAP blogs related or speak specifically of those issues.
• 45:48
  Speaker 2: you will have all the necessary information to understand what it's up.
• 45:54
  Speaker 2: Last one, but not least one part of the information that an apps success is providing us also visibility for our customers.
• 46:01
  Speaker 2: so we're gonna provide information about issues related to authorizations or anything related to SODs and user access et cetera configuration.
• 46:12
  Speaker 2: So depending on how your configured systems your ECCs Your cloud connectors your HANA databases, we can all grab that information and put it in a way that is riddled for you.
• 46:24
  Speaker 2: You're going to understand what do you need to do?
• 46:25
  Speaker 2: And how do you protect your SAP systems against those attacks?
• 46:30
  Speaker 2: also from the missing patches standpoint on how we can automate our process We will automate up to eighty percent of their process telling the customer only they know are missing For this specific environment now reducing time and effort used every second or two months.
• 46:47
  Speaker 2: And also from the code perspective, you know all those consumer sessions that are occurring on premise again or in BTPs.
• 46:54
  Speaker 2: Or if we're doing it depending off of language and developing SAP systems were going to provide information about the threats potentially being introduced into your production system.
• 47:08
  Speaker 2: how can protect and have a little bit of visibility?
• 47:17
  Speaker 2: Well, last one but not least is from the defense standpoint like I mentioned before on Napsys through their research team.
• 47:24
  Speaker 2: It's basically providing all the intelligence and all that knowledge regarding All this a p different products.
• 47:30
  Speaker 2: are we support again going from there?
• 47:33
  Speaker 2: You know they CC world to the BTP words to the clock connector web dispatcher subprime or napsis.
• 47:39
  Speaker 2: it's gonna provide information about those different scenarios in all those different products And what we can see here is a way to communicate
• 47:47
  Speaker 1: the
• 47:49
  Speaker 2: intelligence and their knowledge from all those products through our customers.
• 47:54
  Speaker 2: So they, that are customers can create compensating controls in money told there's a system for these real attacks that exist in the wild.
• 48:03
  Speaker 2: you know some of those like Pablo NGP were just presenting in a few minutes.
• 48:09
  Speaker 0: okay
• 48:11
  Speaker 2: so with that being said
• 48:12
  Speaker 1: I'm
• 48:13
  Speaker 2: going to stop sharing, but i want to give you my a couple last comments.
• 48:21
  Speaker 2: SAP is gonna help tremendously to protect your SAP systems.
• 48:24
  Speaker 2: You're gonna need a little bit more help.
• 48:26
  Speaker 2: from the intelligence standpoint Our Onapsis Research Lab is recognized in their work as number one protecting SAP system and SAP products.
• 48:38
  Speaker 2: So we recommend using our onapsis platform to do that type of protection and you don't maintain your business, protecting the most critical application in your company.
• 48:54
  Speaker 2: With that being said I believe Leah will continue or yes?
• 49:01
  Speaker 2: Great thank you
• 49:06
  Speaker 3: so much Hector!
• 49:07
  Speaker 3: That was great.
• 49:08
  Speaker 3: um i don't know JP did.
• 49:12
  Speaker 3: We can go straight to questions.
• 49:14
  Speaker 3: Yeah, we do have
• 49:17
  Speaker 1: a few.
• 49:17
  Speaker 1: I can wrap up and then will jump two questions straight.
• 49:21
  Speaker 1: yeah just some additional context for you keep as reference in terms of the demo that Hector was performing.
• 49:33
  Speaker 1: so yes all these potential risks identified and mitigated through technology, to their access platform.
• 49:42
  Speaker 1: We have different capabilities that you can leverage on the platform throughout automation.
• 49:49
  Speaker 1: That's a good objective of this part.
• 49:55
  Speaker 1: I think with that we had really time for some questions.
• 50:00
  Speaker 1: so Leah back too?
• 50:02
  Speaker 3: Awesome thank you so much guys!
• 50:04
  Speaker 3: This has been tremendously informative.
• 50:08
  Speaker 3: We did get a few questions and I think maybe we could start at the top.
• 50:12
  Speaker 3: In the first demo, why was the attacker able to reach the SOAP RSC ICF service if the cloud connectors access control didn't allow it?
• 50:27
  Speaker 0: I can grab that and that's very detailed observation.
• 50:32
  Speaker 0: so yes The difference is stuff in their third demo where the backer actually where you see the access control being blocked.
• 50:43
  Speaker 0: Where in a first demo, the attacker doesn't go through the CloudConnector.
• 50:47
  Speaker 0: The attacker goes though its own machine because the attacker has access to the Cloud Connector is supposed to have access to their on-prem system most likely and that's the reason why.
• 50:57
  Speaker 0: so when the attacker tries to reach the SOPRC it does not go thru the cloud connector or directly into the system.
• 51:03
  Speaker 0: if he should try to do this from the demo free you know, the access control will help love that.
• 51:12
  Speaker 0: and but yeah very very detailed for their spirit.
• 51:17
  Speaker 3: Great okay so let's pick another one here.
• 51:20
  Speaker 0: um
• 51:22
  Speaker 3: Let's see before any of this could I have found?
• 51:24
  Speaker 3: That over permissioned integration user Before an attacker did or Did i only learn about it after?
• 51:32
  Speaker 3: so who wants to jump
• 51:36
  Speaker 1: in on that one?
• 51:36
  Speaker 1: Okay Yeah, that's where technology comes into play.
• 51:40
  Speaker 1: Right?
• 51:41
  Speaker 1: So of course you can learn that after the fact... After you identify the incident or compromise but you can perform preemptive assessments for both the configuration and integrations on the code to be able to identify these type of issues beforehand And address them before somebody else takes advantage The ability to do that in an automated way.
• 52:09
  Speaker 1: That's what Hector showed through the Onassis platform demo.
• 52:16
  Speaker 3: Awesome, thank you.
• 52:17
  Speaker 3: I think we'll just Do one more question and this one seemed like a good one.
• 52:22
  Speaker 3: with all of the complexity introduced by integrations How do we keep security from always being a step behind?
• 52:32
  Speaker 3: Who'd like to take that on?
• 52:33
  Speaker 1: Okay i'll Take that because it somehow related.
• 52:37
  Speaker 1: today We cannot escape from this complexity.
• 52:43
  Speaker 1: The integrations, if anything are growing becoming more pervasive or complex.
• 52:52
  Speaker 1: integrating multiple applications now with AI agents in the mix also having a genetic frameworks pulling data from our business applications integrate it with SAS pass, EAS on-prem.
• 53:10
  Speaker 1: So in order for that to be able to be managed there's no other alternative rather than being able to have eyes on it and automation addressing identifying potentially insecure integrations potential over privileged users And also monitoring those systems those integrations, so I would say technology is one way to solve this and that's what we showed here as
• 53:47
  Speaker 3: well.
• 53:49
  Speaker 3: Great thanks JP.
• 53:50
  Speaker 3: i think that's a good question to leave off on.
• 53:54
  Speaker 3: For any other questions in the chat, we will reach out to you individually to get those answered.
• 53:59
  Speaker 3: And just a brief reminder for everyone that this is a session that's been recorded and we'll be sending the link out to your.
• 54:08
  Speaker 3: With that thanks again to JP part two and Hector providing insights into mind of an attacker on how develop plan close vulnerability gaps ensure SAP transformation secure.
• 54:21
  Speaker 3: Thanks, thanks presenters and have a great day everybody.
• 54:24
  Speaker 1: Thank you.
• 54:26
  Speaker 1: Have
• 54:27
  Speaker 3: a good
• 54:29
  Speaker 0: date!