Latest / Onapsis Podcast / Hacking & Defending SAP Live: How Mythos-like AI Models Can Hack SAP Applications

Transcript

Hacking & Defending SAP Live: How Mythos-like AI Models Can Hack SAP Applications · Onapsis Podcast

• 0:03
  Speaker 2: Hello everyone and thanks for joining today's webinar, Hacking & Defending SAP Applications Episode three.
• 0:09
  Speaker 2: How methods like AI models can hack SAP applications?
• 0:14
  Speaker 2: My name is Cecilia Deloy.
• 0:16
  Speaker 2: I will be managing the session before we get started on housekeeping notes.
• 0:21
  Speaker 2: First i want to point out a questions module within the On-Trenty-Fourth platform.
• 0:25
  Speaker 2: We welcome you.
• 0:26
  Speaker 2: enter your question at any time during this presentation.
• 0:31
  Speaker 2: you will answer whatever questions we can at the end of this session.
• 0:35
  Speaker 2: Also there is an
• 0:35
  Speaker 0: option
• 0:36
  Speaker 2: to request a meeting with our experts, feel free to fill out the form on your left hand side.
• 0:42
  Speaker 2: You can always adjust the size of the media player to make it bigger or smaller depending upon your preference.
• 0:48
  Speaker 2: And finally please note that this session has been recorded and we'll share a link for the session after we wrap up today.
• 0:55
  Speaker 2: Now I'm going to pass it over to our presenters.
• 0:57
  Speaker 2: For that Today We have Pablo Artuso Tech Lead, Eponaxis Research Lab and Hector Estinosa, Sales Engineer at Eponaxus.
• 1:07
  Speaker 2: They will be taking us through real-world scenarios And with that I'm handing it over to our speakers.
• 1:16
  Speaker 0: Thank you Cecile.
• 1:18
  Speaker 0: Welcome everybody!
• 1:19
  Speaker 0: To this episode number three of the DocuSeries Hacking and Defending SAP Applications.
• 1:25
  Speaker 0: In this opportunity we are going to be speaking about how artificial intelligence models can be used to hook into SAP applications.
• 1:34
  Speaker 0: So, hope you enjoyed
• 1:35
  Speaker 1: and earn
• 1:36
  Speaker 0: something new from today!
• 1:37
  Speaker 0: This is our agenda.
• 1:40
  Speaker 0: first we're going start with a quick brief interaction then were gonna move in the main point of discussion here that I see what they call AI perfect storm.
• 1:51
  Speaker 0: Then have an entire chapter on attacking demos that i hope that you enjoy it And finally will talk about how protect your business.
• 2:02
  Speaker 0: Hector will show how our platform could help you with this effect.
• 2:06
  Speaker 0: I'm fine, of course we're going to have some time for questions and answers.
• 2:13
  Speaker 1: So
• 2:13
  Speaker 0: before starting i would like to introduce quickly ourselves.
• 2:17
  Speaker 0: Hector You want to start?
• 2:19
  Speaker 1: Sure sure.
• 2:20
  Speaker 1: hi everyone.
• 2:21
  Speaker 1: my name is Hector Espinosa And i am a senior sales engineer.
• 2:24
  Speaker 1: i've been an abscess for almost twelve years now so pretty familiar With the solution in the company.
• 2:31
  Speaker 1: Great
• 2:31
  Speaker 0: thankyou.
• 2:33
  Speaker 0: My name is Pablo Artuso, I'm the leader of the Anapsis Institute Research Labs.
• 2:38
  Speaker 0: My background is mainly technical and I've been doing executing pen tests that are in trainings at conferences but mostly do boonability research for last twelve years as well since I joined Anapses.
• 2:53
  Speaker 0: So let's start with the main point before diving deep into today.
• 3:01
  Speaker 0: Let me stop here and talk a little bit about why we do these live local services.
• 3:07
  Speaker 0: So there are multiple reasons, but if I have to name one i would say that We identify That There is A big gap between the defenders on The attackers knowledge nowadays.
• 3:17
  Speaker 0: Oh of course talking About ACP Knowledge Attackers Already Have the tools Have the knowledge And as we showed in some reports They already are unknown and have the techniques and tactics on how to perpetrate or assess, including also compromise SAP systems.
• 3:40
  Speaker 0: Defenders from other side may lack them.
• 3:42
  Speaker 0: so we believe it was imperative to demonstrate our attacks carried out nowadays basically to empower defenders to help them be much more protected specifically in times where AI could a powerful tool specifically for threat actors.
• 4:02
  Speaker 0: Each of these series will be covered by at least one person from the RL Labs, which is a team I'm part of and The main reason for this Is that we have exposure We have experience And we have deep understanding Of these attacks.
• 4:19
  Speaker 0: Sometimes even because One of our main tasks is to discover a series That sometimes we report These kinds of attacks and work together with SAP, sharing them the knowledge that we have in order to contribute let's say for safer work.
• 4:39
  Speaker 0: In terms of goals what we are looking at is as I was telling you first of all try to empower defenders.
• 4:47
  Speaker 0: second of all trying to keep spreading awareness around SAP applications how important it is.
• 4:56
  Speaker 0: and also finally to keep spreading the knowledge, and to keep contributing with SAP.
• 5:04
  Speaker 0: So I already talked about ORL.
• 5:08
  Speaker 0: but what is this?
• 5:11
  Speaker 0: The Onapsys Research Lab has a specific unit inside the onapsys company which at least we can separate it or split in two big tasks.
• 5:21
  Speaker 0: Well let's say gather thread into data.
• 5:25
  Speaker 0: so by continuously monitoring through a deploying network of sensors, continuously monitoring the tactics and techniques.
• 5:35
  Speaker 0: How what attackers are targeting SAP applications?
• 5:38
  Speaker 0: And how they're using them?
• 5:41
  Speaker 0: Our second task could be related to deep SAP cybersecurity expertise that we have with contact pentests from time-to-time insurance response projects but mainly focused on identifying security vulnerabilities, what we call CODs or previously unknown capabilities with the goal of sharing this knowledge later with ACP Pro response team so they can inform and issue a patch to protect let's say and fix whatever it was exposed.
• 6:19
  Speaker 0: The consequences directly impact every SAP customer in the world.
• 6:29
  Speaker 0: Because for example, if we consider all of their reports that as a charter one that was published some time ago or even all information that were able to gather around CV- those information came thanks to this task that we did.
• 7:00
  Speaker 0: And of course, That's also the reason why were able close work with SAP Closer and help them with mitigating this attack.
• 7:14
  Speaker 0: but when we talk about our expertise on vulnerability research and vulnerability discoveries We can mention some campaigns based on whatever it is that we found, like Recon, ICMD before chains.
• 7:28
  Speaker 0: and yes all the campaigns are an awareness around how to protect against these amounts.
• 7:34
  Speaker 0: That's it!
• 7:36
  Speaker 0: It's one of these customers who benefit most from our team work Every discovery and every piece of research.
• 7:42
  Speaker 0: let say We do feedbacks into the product in multiple ways For example as sero-day rules which she pre-patched, so our customers are already being protected against those vulnerabilities of new threat intel centers campaigns and so on.
• 8:08
  Speaker 0: So let's start with the main topic The SAP Threat Landscape.
• 8:14
  Speaker 0: How was the SAP Thread Landscape previous to Mythos?
• 8:18
  Speaker 0: And how is today that said previously we can consider these.
• 8:24
  Speaker 0: let's say that meters appear, or more-or-less the LLMs like we all know them really empowered.
• 8:32
  Speaker 0: Let's see if we start seeing then in the bounce level at a final part of twenty-five and more less November when Opus four point five six over four point six was released.
• 8:44
  Speaker 0: before that right?
• 8:46
  Speaker 0: We already knew that pictures from a defender perspective were not very great so Already we analyzed that from twenty, twenty-one to twenty three.
• 8:56
  Speaker 0: We saw four hundred percentage increase in terms of a ransomware attacks.
• 9:01
  Speaker 0: We identified there were public exploits being released working exploits right?
• 9:09
  Speaker 0: Three day even less than three days after the patch was published increasing prices on the black market In regards to SAP exploits.
• 9:19
  Speaker 0: so Yeah, numbers that clearly said the picture was not very good.
• 9:26
  Speaker 0: And if you want to keep exploring around these numbers and some references I really recommend you go see our Tata report.
• 9:35
  Speaker 0: Also we saw there were a lot of news in terms of ADP cybersecurity tasks or security topics But also, most importantly on twenty-twenty five as I already mentioned we saw the appearance of a new studio that was being exploited in the wild and hit dozens of companies.
• 9:56
  Speaker 0: That we can consider to be pretty much mythos right?
• 9:59
  Speaker 0: And even surprisingly the Mtrends which is Mondians company Google Animal Threat Intelligence Report for first time listed an SAP related vulnerability And not only that, but that same vulnerability was categorized at the single most exploited vulnerability in twenty-five.
• 10:20
  Speaker 0: So clearly again a picture wasn't very great.
• 10:26
  Speaker 0: I Very much like this slide because i think it shows much better than express these words But previously right let's say couple of years ago whenever you want to know how to assess How to compromise?
• 10:45
  Speaker 0: How to say security?
• 10:46
  Speaker 0: You need it know a lot of property knowledge.
• 10:50
  Speaker 0: For example, you need to know kernel components what is the message server and gateway which are different protocols that are appropriate protocols like RFC or Direct Protocols.
• 11:01
  Speaker 0: You can also know about mechanisms, standard users, profiles techniques concepts.
• 11:08
  Speaker 0: so there was alot of knowledge required in order assess from a security perspective on SAP system.
• 11:18
  Speaker 0: Today, all that knowledge or most of the knowledge is held by DLM and these LMs with no specific training around SAP.
• 11:33
  Speaker 0: this what we want to show you today.
• 11:35
  Speaker 0: The main goal for today Is how simple it's to craft a prompt right?
• 11:42
  Speaker 0: That requires zero sub-knowledge And with this kind of simple prompts, it's even possible to compromise entirely SAP applications.
• 11:56
  Speaker 0: So in terms of threat landscape post-nitils we can mention some things that some of them will be cross SAP so not only shared with SAP but also other application platforms because you're talking about things like a pretty general HNPKI In Shintex AI, today LLMs for instance.
• 12:20
  Speaker 0: they have the knowledge.
• 12:21
  Speaker 0: Our nations know how to use that knowledge.
• 12:24
  Speaker 0: They know how run security tools and craft code.
• 12:28
  Speaker 0: How do you execute it?
• 12:29
  Speaker 0: How learn from their results And how to iterate a code.
• 12:34
  Speaker 0: in terms of surface For instance We had all these protocols, these misconfigurations Again, an expert person should have known in order to assess an SAP system.
• 12:47
  Speaker 0: Now it's held by ELM so its possible to produce that
• 12:51
  Speaker 1: gap
• 12:52
  Speaker 0: for a person who maybe has no SAP knowledge To access the SAP systems and interact with them.
• 12:59
  Speaker 0: In terms of public POCs The Asians are just one Google search away Of downloading a working POC And launching against an SAP System that could be unmitigated and therefore compromise it.
• 13:15
  Speaker 0: And of course, in terms of current keywords we all know that SAP stores the most important data company financial data intellect for personal information whatever... ...and the consequences of compromising an SAP system sometimes would even be immeasurable.
• 13:36
  Speaker 0: In terms of models We can divide two big groups.
• 13:40
  Speaker 0: I will not state too much in this one, but we can mention those kind of models that are general purpose like chapter activity five or four sonnet opus even fable.
• 13:51
  Speaker 0: That was with the latest.
• 13:52
  Speaker 0: you know it was disabled for the time being.
• 13:55
  Speaker 0: But all these Models our focusing on general purposes nonetheless They execute pretty well when he comes to some security things and i'm gonna show You also that they all attack demos that you're going to see afterwards were done with these kind of models.
• 14:16
  Speaker 0: Whereas also, what is called security-focused models like mythos, like chat.gd.find.polyfine slash cyber which are dedicated especially to cybersecurity tasks and yet they are even more important or interesting to analyze when it comes.
• 14:36
  Speaker 0: So, enough with that interaction.
• 14:42
  Speaker 0: Let's move on and let start the attack.
• 14:45
  Speaker 0: light.
• 14:45
  Speaker 0: demos.
• 14:46
  Speaker 0: Before starting I would like to mention we have three demos.
• 14:50
  Speaker 0: The first two are strictly following more or less this loop which is First of all map All things that system can be exposing Like a different landscape.
• 15:04
  Speaker 0: Then reason about that.
• 15:06
  Speaker 0: Try to understand what means that they have, for example this specific port exposed.
• 15:14
  Speaker 0: A third phase would be try to exploit ads.
• 15:17
  Speaker 0: and the fourth bug will be impact right?
• 15:20
  Speaker 0: The impact it's being caused.
• 15:22
  Speaker 0: And first two demos.
• 15:23
  Speaker 0: we're going see that the prompt is almost the same only thing you are gonna change in objective of those thought that two demos was already enough to show you how simple it could be, to graph Azure sub-knowledge prompt to compromise on SAP system.
• 15:42
  Speaker 0: So we made a step forward and were gonna see the demo is not guiding anything.
• 15:49
  Speaker 0: It's not specifically saying something that requires an SAP knowledge but its going to focus like giving specific information about how to pursue based just reading then use, let's say nothing in terms of technically from SAP.
• 16:09
  Speaker 0: So let's go with the first one.
• 16:19
  Speaker 0: this is the screen of the attacker will be using Cloud Code In This Case.
• 16:25
  Speaker 0: so first it showing that he has nothing already pre-configured and you want to see for us the prompt.
• 16:33
  Speaker 0: as I was telling you its gonna mention something about.
• 16:37
  Speaker 0: okay here is a system we need to assess.
• 16:40
  Speaker 0: This is the plan, first map then reason and exploit.
• 16:42
  Speaker 0: And what we want?
• 16:44
  Speaker 0: you to create a new user... ...and tell me all different steps that I have to do to connect with this new user.
• 16:54
  Speaker 0: That's it!
• 16:56
  Speaker 0: We are not entering more prompts.
• 16:59
  Speaker 0: Of course AI will work.
• 17:02
  Speaker 0: It has been working for thirteen or fourteen minutes.
• 17:05
  Speaker 0: In the phase one is mapping all the threat landscape and it already says that he has a major finding, something around ACP star.
• 17:15
  Speaker 0: The attacker just posted or I suppose to show you demo.
• 17:17
  Speaker 0: but in Phase two let's reason.
• 17:20
  Speaker 0: now we have these findings.
• 17:22
  Speaker 0: what should i do?
• 17:25
  Speaker 0: It will start with their recommendation which is strategy A. so phase three is just explained again.
• 17:34
  Speaker 0: We have been working more or less for twenty, twenty-two minutes and the AI tells hey are
• 17:40
  Speaker 1: you ready
• 17:41
  Speaker 0: finished?
• 17:41
  Speaker 0: You have your new user.
• 17:44
  Speaker 0: This new user has admin privileges And this is a way to connect with the system.
• 17:50
  Speaker 0: So if we see there There's that URL The attacker is connecting to that URL Using credentials of the AI provided Once it's logged in which is, yeah I've already.
• 18:05
  Speaker 0: the attacker has a user with full privileges inside the SAP system.
• 18:09
  Speaker 0: This is incredible and just to show you when you go to profiles this user had SAP all.
• 18:17
  Speaker 0: so the consequences are vast because it means that he has full power on that system and can do whatever she wants shuttle system compromise it mobilatorily or So as a kind of summary, a quick summary.
• 18:34
  Speaker 0: Again the prompt can be summarized in The following sentence I
• 18:40
  Speaker 1: don't
• 18:40
  Speaker 0: know anything about this IP so i would complete a relying loop.
• 18:43
  Speaker 0: that's literally what the prompt says.
• 18:46
  Speaker 0: Then again maps everything propose ways and exploit a CVE or a misconfiguration?
• 18:51
  Speaker 0: Don't care.
• 18:52
  Speaker 0: And What I want was to you to create an new privileged user and give me the credentials.
• 18:58
  Speaker 0: That's the prompt!
• 18:59
  Speaker 0: What happens technically?
• 19:02
  Speaker 0: So basically, the AI first assess or maps the landscape of a system.
• 19:08
  Speaker 0: Then it finds out that the client's zero-zero one is misconfigured and ACP star able to be used as login user which is a critical misconfiguration.
• 19:18
  Speaker 0: And then through an HTTP interface It has been able execute RFC functions.
• 19:25
  Speaker 0: Finally logging also through an ACP or HTTP interface.
• 19:29
  Speaker 0: but this was done as you saw automatically.
• 19:32
  Speaker 0: The attackers just give one prompt, no SAP expertise and no specific data.
• 19:41
  Speaker 0: Let's move to the second one.
• 19:43
  Speaker 0: so in case we're going to go a bit further on the idea is change the vendors bank account vendor.
• 19:52
  Speaker 0: So initially in these demo were gonna see at first that it will start As likewise as the other one, launching code code.
• 20:02
  Speaker 0: And here is the prompt which is exactly the same.
• 20:06
  Speaker 0: The system changes and again the objective.
• 20:10
  Speaker 0: so instead of now creating a user what I want you to do is execute something exploit something for it and give me privileged access.
• 20:20
  Speaker 0: that's all.
• 20:22
  Speaker 0: So this was more complex.
• 20:26
  Speaker 0: but First of all is assessing a map in the system landscape, different ports and service.
• 20:32
  Speaker 0: It realizes that there's... The gateway is misconfigured but it downloaded a public POC But didn't work because some small details.
• 20:43
  Speaker 0: So here you can see There are second prompt which is again not saying anything specific from SAP.
• 20:48
  Speaker 0: Just say more information like Python.
• 20:51
  Speaker 0: choose install Because he was trying to use Python three.
• 20:54
  Speaker 0: And please consider seeing the results, analyzing their result that you are getting and trying to change what it did but nothing specifically.
• 21:03
  Speaker 0: And after a couple more minutes of work I would say between...I don't recall exactly about let's say ten or twelve minutes we're gonna start seeing that.
• 21:13
  Speaker 0: um The AI realizes that the remote core execution is confirmed.
• 21:21
  Speaker 0: That is possible without any kind of authentication remote code in the system, remote commands.
• 21:32
  Speaker 0: So here we are.
• 21:33
  Speaker 0: so as you can see there uh We have the exploit already finished or yeah and it's possible to be used.
• 21:40
  Speaker 0: so The attacker now what is doing?
• 21:42
  Speaker 0: Is okay.
• 21:43
  Speaker 0: Now with the access that you have I would like to talk to list the top ten vendors ordered by billing.
• 21:50
  Speaker 0: grab the first one And modify the bank account of that vendor and put some values that the attacker wants.
• 21:59
  Speaker 0: So here, what you're going to see now is like let's change our shoes.
• 22:04
  Speaker 0: and we are at the admin stand of the system And we are logging it through SAP GUI.
• 22:08
  Speaker 0: This is not part of attack.
• 22:09
  Speaker 0: this is just to show You That The Vendor data well off these specific vendor that is gonna be changed Is there?
• 22:26
  Speaker 0: doing basically is through the OS command execution, it's launching SQL queries directly to the database and modifying those data.
• 22:35
  Speaker 0: Those are routing number on their account number.
• 22:39
  Speaker 0: so at the end we're gonna see a message after fifty minutes more or less before work when I say final message of the plug code saying that they changed was already done as you can see there.
• 22:51
  Speaker 0: So then new value for the routing number in the account number all ready in place.
• 22:56
  Speaker 0: So again, if we show this from an admin perspective and will launch the system when we showed information on the vendor.
• 23:05
  Speaker 0: We're going to see that new values are written over there.
• 23:13
  Speaker 0: so um Again in summary what we have here is That uh From the prompt perspective it was exactly same.
• 23:23
  Speaker 0: once you know it's nothing specific which has changed that?
• 23:27
  Speaker 0: We want to gain previous access instead of email user in comparison with demo one.
• 23:32
  Speaker 0: And finally, that's an extra prompt of trying to modify those vendors bank account data from a technical perspective.
• 23:40
  Speaker 0: what happened was first at the AI again assessing the landscape without authentication using the sub star service specific component.
• 23:49
  Speaker 0: once they realized it that the gateway was open because of a set info misconfiguration It executed commands abusing that misconfiguration.
• 23:59
  Speaker 0: And finally, as a first step once it was possible to execute OS commands.
• 24:06
  Speaker 0: It pivoted into HANA in the database and modified the bank account of the vendor without again this was provided with out authentication just because simple problems.
• 24:23
  Speaker 0: let's move on to the final demo number three which is related to shutting down the system.
• 24:30
  Speaker 0: In this case We're going to see again the same framework of attack, launching clock code.
• 24:38
  Speaker 0: The prompt is a little bit different now but it says nothing specific about SAP.
• 24:42
  Speaker 0: It's just saying this system and I heard that there was an exploit from twenty-twenty five out there created by this threat group.
• 24:53
  Speaker 0: please try to assess if these systems are vulnerable.
• 24:57
  Speaker 0: so first thing we do is collecting different POCs that are published online and start analyzing them.
• 25:06
  Speaker 0: Downloaded then analyze it, this also I think was instructed by the probe because we didn't want to run any kind of POC.
• 25:16
  Speaker 0: so he tried to look for the POCs assess them analyze them try to understand which one could really work Because with specific vulnerability there were a lot of POCs publicly that we're not working at all.
• 25:31
  Speaker 0: So here, you have a ranking and it's grabbing the first one-the most recommended right?
• 25:36
  Speaker 0: In this case is just say hey yeah I don't know.
• 25:39
  Speaker 0: run this one.
• 25:40
  Speaker 0: try to confirm if there are remote execution possible in these system.
• 25:48
  Speaker 0: One way of exploiting was very famous was to upload a web shell.
• 25:52
  Speaker 0: This is exactly what this script is doing.
• 25:56
  Speaker 0: What is going to happen now, it's that LAI has already demonstrated the full remote correction is working and its uploading this web shell right?
• 26:09
  Speaker 0: To that specific URL.
• 26:11
  Speaker 0: So finished, there are no questions possible.
• 26:14
  Speaker 0: so if you just as an attacker copied these I wanted try by yourself to confirm here.
• 26:20
  Speaker 0: You can see at a workshop was deployed and he's actually working.
• 26:24
  Speaker 0: So you have remote code execution in the system, again once more.
• 26:27
  Speaker 0: In this time we had a system.
• 26:29
  Speaker 0: so now The main goal of these demo was to shut down the system?
• 26:34
  Speaker 0: So if they're tackling this case is just prompting This to the AI asking him to shut on the system.
• 26:42
  Speaker 0: could the Attacker be with command in the web shell?
• 26:47
  Speaker 0: yes Of course but the idea will see.
• 26:48
  Speaker 0: you say I. so just ask it please try it out for me.
• 26:52
  Speaker 0: so afterwards if we go back to the web browser and refresh, you're going see that system is already down.
• 27:04
  Speaker 0: So again as a quick summary on the left We have the prompt.
• 27:09
  Speaker 0: The prompt didn't say anything.
• 27:10
  Speaker 0: rather than just here's the system.
• 27:12
  Speaker 0: there were POC about it.
• 27:15
  Speaker 0: sorry CD about it.
• 27:17
  Speaker 0: look for POCs improve RCE And then shutdown the system.
• 27:23
  Speaker 0: What happened?
• 27:24
  Speaker 0: On the technical side look for different public POCs, it analyzes them.
• 27:30
  Speaker 0: It confirmed that the vulnerability was possible to exploit.
• 27:33
  Speaker 0: It exploited and dropped a white shell which shut down this system.
• 27:38
  Speaker 0: All of those were done only by just few instructions as you saw Which didn't require SAP knowledge at all.
• 27:50
  Speaker 0: So that's everything about attacker demos.
• 27:54
  Speaker 0: on the attacker part I hope now it could be possible to do with AI nowadays.
• 28:04
  Speaker 0: Let's go and change our shoes, let us put them on the defender side.
• 28:08
  Speaker 0: so how can we protect our business?
• 28:11
  Speaker 0: which are the remunerations and defenses that we can implement?
• 28:15
  Speaker 0: So specifically for these demos I will do this part a little bit quickly because the actor would explain better than me about his demos.
• 28:27
  Speaker 1: but
• 28:28
  Speaker 0: On demo one, we of the hacker exploited the default credentials.
• 28:32
  Speaker 0: Something that is well known as kernel emergency mechanism.
• 28:36
  Speaker 0: that exists from the nidis and um as a general recommendation in order to be protected against these.
• 28:42
  Speaker 0: there are a few configurations in terms of profile parameters ,in terms of properly configuration on default users that can be applied.
• 28:49
  Speaker 0: But in our, on the analysis platform that let's say in a product.
• 28:55
  Speaker 0: you're going to see that afterwards Hector will show this.
• 28:58
  Speaker 0: You have two parts when there is access and whether it's defend quickly mentioned in days assesses like they'd say their product way of analyzing system understanding if it is vulnerable or not.
• 29:09
  Speaker 0: And then it's more reactive part where alerts you what something happened.
• 29:15
  Speaker 0: So from the assets part a couple of modules that can list you when ACP Star is not properly configured.
• 29:24
  Speaker 0: Proper parameter isn't configured, et cetera.
• 29:26
  Speaker 0: and from the defense side we catch, we monitor or we alert When somebody logs in as ACP star and grants ACPO privileges to our user.
• 29:36
  Speaker 0: The demo two was about also very well known an attack on misconfiguration That it's this gateway misconfiguration over there while permission allowed as set info.
• 29:46
  Speaker 0: It was known as part of the Chinca Blazapak in the year, and the general recommendation is to tie it a little bit more.
• 29:54
  Speaker 0: The Gateway ACL to protect more the second fold which sounds simple but actually really complex when you come through.
• 30:03
  Speaker 0: So from a set perspective we also have different modules that will let us know once the key foots widely open on.
• 30:10
  Speaker 0: for the defense side We detect every time the registrations happen.
• 30:15
  Speaker 0: The first two were misconfigurations, which means that can come back at any point in the time with error or human error.
• 30:24
  Speaker 0: Or a tool error.
• 30:25
  Speaker 0: The demo three was about vulnerability, which is probably already patched unless it's a bypass.
• 30:32
  Speaker 0: so the only recommendation here would be to apply the patch from a safe point of view it's possible to, I mean on Apsis reports whenever there is an impact system.
• 30:45
  Speaker 0: And from a different point of view OP also mentions when ever another every time that this is exploited.
• 30:54
  Speaker 0: so these are the kind of coverages we can mention that exist.
• 31:00
  Speaker 0: and finally in this is a slide more for reference rather than for me explaining now because three main points.
• 31:11
  Speaker 0: So the last general recommendations will be to reduce the surface, limit the port and service to just teams that actually need to use them.
• 31:19
  Speaker 0: And finally to monitor the crown shovels which is monitoring your system in every kind of activity that could be problematic.
• 31:30
  Speaker 0: So protecting against this attack This part of Hector we'll further explain so I hand it over to you Hector.
• 31:39
  Speaker 1: Perfect.
• 31:41
  Speaker 1: Thank you so much, Pablo.
• 31:43
  Speaker 1: So perfect.
• 31:44
  Speaker 1: what I'm going to do now is...I am gonna present how with the onapsis platform our customers can be protected against those basically attacks that Pablo just demonstrate and i'm gonna share my screen okay?
• 32:07
  Speaker 1: Okay!
• 32:08
  Speaker 1: Now You Can See My Screen.
• 32:09
  Speaker 1: First Attack.
• 32:10
  Speaker 1: Basically We With the Napsys platform, there are basically two phases or two steps that you need to take into action for every issue.
• 32:20
  Speaker 1: So number one we want to identify if your system is vulnerable for that attack?
• 32:26
  Speaker 1: of course where?
• 32:27
  Speaker 1: We already know that were looking for any information related to sub start user and not being configured correctly.
• 32:35
  Speaker 1: The Napsy's platform with that report showing all the different results from three thousand plus test cases that we have in our solution.
• 32:43
  Speaker 1: Actually, that number keeps increasing.
• 32:45
  Speaker 1: but in this specific scenario what Pablo was mentioning is about hey if that sub-star user properly secure and also it is properly secured like a someone who's basically able to use them.
• 33:00
  Speaker 1: so our solution is telling us here for example that in SH five, which is one of the system where they attack was executed.
• 33:10
  Speaker 1: The sub-star user was it's not actually enabled and here we can see that a sub star user It's now properly secured.
• 33:20
  Speaker 1: One more thing that on apps is going to provide also for each of those issues.
• 33:24
  Speaker 1: Is this solution?
• 33:25
  Speaker 1: So what would you have to do To protect your season against that scenario or that misconfiguration?
• 33:31
  Speaker 1: In this case?
• 33:33
  Speaker 1: apart from that what you will see is from the on-appsys platform, it's okay while you are basically fixing those issues how we can monitor your system.
• 33:44
  Speaker 1: How we can ensure or that your SAP System is still protected because at the end of the day if you don't apply the configuration for changing the systems then you're still unprotected.
• 33:56
  Speaker 1: so the on appsy solution seems like hey there some type activity in this system.
• 34:01
  Speaker 1: So number one, and if you think about the LLM what it's doing is basically pinging different clients to see which ones he's receiving a feedback.
• 34:10
  Speaker 1: Which one is enabled?
• 34:13
  Speaker 1: With that being said they say that client zero-zero-one didn't have a sub start user enable.
• 34:19
  Speaker 1: now its basically sending or receiving a response to their LLm also from the on apps with different protocols monitoring capability.
• 34:32
  Speaker 1: It's also telling us that someone locks in with the sub-star user into this system, which makes it again part of their exploitation process.
• 34:40
  Speaker 1: that Pablo just demonstrated now.
• 34:43
  Speaker 1: The NAPSY is capturing all that information to different products.
• 34:48
  Speaker 1: and last one but not least on is look at the scenario.
• 34:54
  Speaker 1: once you're logging in a sub star user they attack basically what Look, they create another user.
• 35:01
  Speaker 1: They assign a high profile.
• 35:03
  Speaker 1: so when the security team is trying to do the investigation and seeing what's happening in their system it's more difficult for them to detect that attack if possible or it was executed.
• 35:16
  Speaker 1: In this case while we are demonstrating with an Apsis platform we're telling the customer hey someone With a sub-star user logs into your system And basically connected and create another user in that high profile, which is something from the security perspective shouldn't happen.
• 35:38
  Speaker 1: That's a way we captured where first you're going to tell if your system is affected by mis-configuration.
• 35:45
  Speaker 1: then from the defense standpoint were gonna tell somebody using specific misconfigurations.
• 35:58
  Speaker 1: Then for the scenario number two, The main point of this one is a big configuration also.
• 36:05
  Speaker 1: So basically your gateway it's not configured correctly.
• 36:09
  Speaker 1: The onapsis platform as you can see here in this part after executing that full assessment It's telling us there are huge vulnerability or huge misconfiguration in system which affects multiple systems connected to our onapses platform.
• 36:24
  Speaker 1: One of them is TI-I.
• 36:27
  Speaker 1: Pablo executed the attack.
• 36:31
  Speaker 1: Then from this part, we can find a solution.
• 36:35
  Speaker 1: what would you have to do for the configuration standpoint?
• 36:38
  Speaker 1: To mitigate that risk?
• 36:40
  Speaker 1: That's why assess is going to be in charge
• 36:42
  Speaker 2: of.
• 36:44
  Speaker 1: and then The last one but not least on it is from another boy base or form they continue to monitor.
• 36:50
  Speaker 1: your Nazi Solution is capturing multiple events.
• 36:53
  Speaker 1: well the band that We are focusing right now is this one, starting potential and dangerous IFC execution.
• 36:59
  Speaker 1: So basically understanding that you have the risk in your environment someone is trying to remote execute commands through an SAP system In this case DI-One.
• 37:12
  Speaker 1: This is a user that was basically... This is the user that's executing those commands And then after solution when it go deeper into their results It's going to tell you how many times science, the defense product is enabled into that system.
• 37:30
  Speaker 1: That issue has been triggered.
• 37:31
  Speaker 1: but also it's gonna give you more in-depth information and this is a translation coming from your SAP logs.
• 37:38
  Speaker 1: so if you're familiar with SAP Logs takes time an effort basically make sense of what information its being recorded there.
• 37:47
  Speaker 1: but on apps while telling you are here putting away pretty readable and easy to understand and it's telling us from this GI-One system, someone is a super user basically try to remote execute commands on that specific systems.
• 38:06
  Speaker 1: And the connectivity in execution was successful.
• 38:10
  Speaker 1: so part of our information is going provide customers they can protect their system against these attacks.
• 38:20
  Speaker 1: And then last one, but not this one is regarding the visual composer.
• 38:24
  Speaker 1: This is a vulnerability that we found last year and it was actually pretty high in the scale of attacks have we see during last year?
• 38:35
  Speaker 1: The first thing I'm going to tell to the customers how you can protect your system against these vulnerabilities that you may not have information about because he's a zero date or something like our research lab discovering their wall and even we work with SAP for them to release a patch or fix that issue, is still there's gap in between because we know the information.
• 39:00
  Speaker 1: We want help our customers regarding those CODs attacks.
• 39:04
  Speaker 1: so we have our Trade Intel Center where put all of this information into just one pane of glass.
• 39:09
  Speaker 1: This information comes from our research lab And it basically tells us about the customer.
• 39:14
  Speaker 1: These are the latest things you need to be aware happening in SAP world.
• 39:21
  Speaker 1: So apart from that, like I said last year the Visual Composer we already have information before SAP recent patch where we tell the customer hey this is something pretty
• 39:34
  Speaker 0: high
• 39:35
  Speaker 1: right?
• 39:35
  Speaker 1: In the race of SAP systems This is something you should be aware it's happening and also please validate if your affected by that issue.
• 39:46
  Speaker 1: So when I go to assess and now, what do you need?
• 40:16
  Speaker 1: the time when we discovered this vulnerability and would release information to our customers, SAP didn't have a patch yet because they were working on that fix but it was something that was accepted.
• 40:29
  Speaker 1: And then on AppSys you know trying to be proactive will release a test case in an alert for our customer so they can be protected from things already no exist within the SAP world okay?
• 40:44
  Speaker 1: So, I know by then it was pretty quick but part of the idea is how simple and how quick we can protect our SAP environments.
• 40:55
  Speaker 1: Okay?
• 40:55
  Speaker 1: From the asset standpoint its more from identification.
• 40:59
  Speaker 1: for the defense standpoint Its more from continuous monitoring or compensating controls that were offered.
• 41:04
  Speaker 1: But also one more item is the threat intel center which number one capability that we have in our on-appsys platform, where our research team and the team is led by Pablo.
• 41:17
  Speaker 1: It's basically publishing information about their latest and greatest threats and SAP issues.
• 41:22
  Speaker 1: so everybody should be aware of what they're having there environment.
• 41:28
  Speaker 1: Then last will be the Compensating Control.
• 41:29
  Speaker 1: This something it'll help to maintain your system secure at end of day Once you connect your on-Appsys Platform through your SAP systems You gonna find multiple issues.
• 41:42
  Speaker 1: some of those issues are going to take longer, more than you know weeks or months.
• 41:46
  Speaker 1: To be fixed.
• 41:48
  Speaker 1: so the idea is to have a compensating control that it's monitoring your system.
• 41:52
  Speaker 1: twenty four seven That can allow You two keep working in the highest risk as an artist that you're having Your environment but also Having A police In The door like we said.
• 42:03
  Speaker 1: Two tell you if someone Is trying Take advantage Of this.
• 42:06
  Speaker 1: Issues We haven't been able to fix yet because It takes time and the change management controls etc.
• 42:14
  Speaker 1: So with that being said, does our demo in our presentation?
• 42:18
  Speaker 1: If you have any questions please feel free to put them on the chat.
• 42:23
  Speaker 1: Perfect!
• 42:23
  Speaker 2: Thank you so much for having me.
• 42:28
  Speaker 2: It was very interesting and I can see that the chat is busy already.
• 42:33
  Speaker 2: it's all we have.
• 42:35
  Speaker 2: a first question coming in an let me start how much of the attack chain was actually fully automated by the AI versus requiring human prompt engineering when dealing with SAP's proprietary protocols.
• 43:01
  Speaker 1: You mean Pablo?
• 43:03
  Speaker 2: Yeah, part of your mute
• 43:05
  Speaker 0: So sorry for that.
• 43:06
  Speaker 2: um yeah
• 43:07
  Speaker 0: I can take this one in the
• 43:09
  Speaker 1: live demos.
• 43:10
  Speaker 0: Actually we were not uh dealing with property protocols.
• 43:15
  Speaker 0: In reality, demo two is against the SAP Gateway who has some proprietary protocol which is RFC but it was all encapsulated inside a public exploit.
• 43:26
  Speaker 0: So we actually didn't have to deal with property protocols.
• 43:32
  Speaker 0: However what I can say?
• 43:36
  Speaker 0: that if I mean, we tried to reduce because it was the goal of the demo.
• 43:41
  Speaker 0: To show almost no interaction going back and forth with AI rather than just a simple prompt.
• 43:48
  Speaker 0: but in real life if you want keep discussing and prompting the AI.
• 43:55
  Speaker 0: even an expert is behind on prompting.
• 44:00
  Speaker 0: Yeah, I will say that dealing with program protocols is not something it would be a big problem for the AI.
• 44:09
  Speaker 0: It'll take time to learn about but at end of day you mostly handle it pretty well.
• 44:22
  Speaker 2: Alright thank-you.
• 44:25
  Speaker 2: then let's go on.
• 44:27
  Speaker 2: Since AI allows attackers to move laterally and execute exploits at machine speed, traditional reactive testing cycles seem obsolete here.
• 44:38
  Speaker 2: How does an access autonomous defense catch these AI-paced zero day attacks before they can pivot from a BCT application into the S for HANA core?
• 44:54
  Speaker 1: On that piece, basically the different product is using their knowledge.
• 44:59
  Speaker 1: That it's coming from now for Pablo's teams.
• 45:02
  Speaker 1: so every time we found anything in there while with basically update our napsis customers database with the latest and greatest information but also from that standpoint they are an Information about you know from the assessment point week We need to also use in a way that we need to identify what are the misconfigurations that could potentially be used from this, you know?
• 45:28
  Speaker 1: From these attacks.
• 45:29
  Speaker 1: And also...from their defense standpoint We can create a specific custom alert for things in the wall.
• 45:40
  Speaker 1: Not only our research team is providing to customers but they want to monitor.
• 45:50
  Speaker 1: that will be the right use for on AppSysPath or on Assets.
• 45:53
  Speaker 1: Okay, then I would say it's just two
• 46:02
  Speaker 2: other questions and we need to rest here.
• 46:06
  Speaker 2: in your second demo The attacker changed a vendor's bank details directly into database without ever having a valid SAP user.
• 46:15
  Speaker 2: how is that possible?
• 46:18
  Speaker 0: Ah okay yes this really.
• 46:21
  Speaker 0: let us take our question.
• 46:24
  Speaker 0: But yes, once you have access to the OS of the SAP system and your running let's say OS commands as what is called an SAD-ADM which is the OS user from an SAP perspective.
• 46:38
  Speaker 0: There is like a trust inner thing trust circle between what it's call the OS on the database.
• 46:46
  Speaker 0: so even without having access which let's say lives in the application side inside of the SAP system, once you have access to the OS.
• 46:57
  Speaker 0: You can do whatever if you want Let's Say In The Database and this is something that it not very known but It Is Something Important To Understand Because It Could Happen Also From The Application Side Right?
• 47:12
  Speaker 0: If You Are Powerful Enough Inside The SAP System as deep, and you can even get to the OS from the database.
• 47:26
  Speaker 0: That's a very important concept for fully understanding.
• 47:32
  Speaker 2: Okay thank-you.
• 47:33
  Speaker 2: then I would say one last question.
• 47:37
  Speaker 2: in the BTP to FBHANA scenario You showed how an attacker could use AI guided exploit to poison business logic and trigger full operational shutdowns.
• 47:50
  Speaker 2: that doesn't have deep SAT expertise, what is the number one leading indicator or alert they should look for to know?
• 47:58
  Speaker 2: an AI driven attack if underway?
• 48:16
  Speaker 1: you know, yeah we provide a lot of information.
• 48:25
  Speaker 1: It's about the threats and issues that can identify in an SAP system.
• 48:29
  Speaker 1: so coming from authorization means configuration patches even on custom code like with put out a lot effort providing information to our customers not only by helping them automatically identifying their issue into this system but also what they will have do protect environment.
• 48:51
  Speaker 1: And apart from that, we're also gonna tell them okay if you don't do anything.
• 48:54
  Speaker 1: If you keep your system in the same way it is right now with that issue and environment this what would be worst outcome?
• 49:03
  Speaker 1: This information is all provided under access so being helpful for their security operations center teams because at end of day where see they've got... They are in charge to protect their SIP environments But at the same time, they don't have their knowledge.
• 49:21
  Speaker 1: They don't what we call the Japanese language to understand how to protect an SAP system.
• 49:27
  Speaker 1: Onapsis is putting a lot of effort on that piece and providing the necessary information so you can understand first why it's there risk?
• 49:36
  Speaker 1: What are the worst alcohols?
• 49:38
  Speaker 1: but also solution affecting in your SAP environment.
• 49:43
  Speaker 1: All that encapsulating into the assessed product Also from the threat intel center.
• 49:49
  Speaker 1: What is important, we need to understand what to protect.
• 49:53
  Speaker 1: But if you don't know where to protect like how are going do that?
• 49:57
  Speaker 1: So they're not just trading the center but it's all information fed by our research team.
• 50:02
  Speaker 1: It's gonna provide that type of information for customers so their gonna know.
• 50:07
  Speaker 1: okay from today these have biggest attacks or this has been the biggest threats that were facing or SAP customers are facing.
• 50:15
  Speaker 1: These things should be aware happening and then we're going to keep all the necessary information for customers.
• 50:22
  Speaker 1: But also, I can analyze your system if you are basically putting it out there.
• 50:29
  Speaker 1: So that's where our biggest effort is just providing all of this because sometimes security operations center teams don't have knowledge and visibility.
• 50:41
  Speaker 1: so how our on-app solution will be able to help our customers with that.
• 50:51
  Speaker 2: Amazing, thank you!
• 50:53
  Speaker 2: I would say it brings us time for any other questions in the chat.
• 50:58
  Speaker 2: we will be reaching out individually and get those answered as well.
• 51:02
  Speaker 2: Also just a brief reminder everyone listening this session has been recorded.
• 51:06
  Speaker 2: The link to recording is e-mailed afterwards.
• 51:11
  Speaker 2: Thanks again to all of your speakers and everybody joining this briefing.
• 51:15
  Speaker 2: Have a good day.
• 51:16
  Speaker 2: Thank You
• 51:18
  Speaker 1: Thank you, everyone.
• 51:19
  Speaker 1: Have a good day.