Fixing the back-door SAP-Oracle security hole

Black Hat security conference will address enterprise applications, hardware, and big-picture Internet issues

At the Black Hat security conference next week, one presentation will focus on a way to insert a back door into SAP's ERP (enterprise resource planning) applications. SAP's business software is often the core of a company's operations and is used to manage invoicing, human resources, procurement, and billing, among many other functions.

SAP's software uses databases from companies such as Oracle, said Mariano Nuñez Di Croce, director of research and development for Onapsis, a company that focuses on penetration testing for SAP systems and others such as Oracle's PeopleSoft and JD Edwards enterprise applications.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

Many companies do not configure the Oracle database correctly, which makes the SAP system vulnerable to attack. "What we have found is, it is possible instead of modifying the program you can connect to the database and modify the code directly in the database," Nuñez Di Croce said.

The problem with SAP and the Oracle database has been known for a few years, although Nuñez Di Croce recently figured out how to slip a "back door" into a program in the database that can then send data to a remote hacker. Because the Oracle database does not conduct an integrity check of the source code, the attack would be difficult to detect.

It would allow an attacker, for example, to forward all information related to a new customer account. It could also let a hacker modify shipping orders or collect the login details when employees log on to the SAP system, he said. "It's amazing to see how many experienced SAP customers don't know about this vulnerability," Nuñez Di Croce said.

To remedy this, Nuñez Di Croce's company plans later this month to release a tool that will check to ensure applications within the database haven't been tampered with. The tool creates a hash value, or a unique numerical identifier based on the source code for applications. If the tool scans an application later and it has a different hash value, it may have been tampered with, indicating a back door, Nuñez Di Croce said.

Nuñez Di Croce's presentation will be in Black Hat's application security track. The conference will have two other tracks, one focusing on the "big picture" security issues and one dedicated to hardware, according to the conference schedule.

In the big picture track, Stephan Chenette, principal security researcher for Websense Security Labs, will give a presentation on a project called Fireshark. The project aims to streamline collecting information on the tens of thousands of Web sites that may contain malicious code and are designed to attack unsuspecting visitors.

Fireshark "is capable of visiting large collections of Web sites at a time, executing, storing, and analyzing the content and from it identifying hundreds of malicious ecosystems," Chenette wrote on Black Hat's Web site.

Join the discussion
Be the first to comment on this article. Our Commenting Policies