SAP Vulnerability Could Expose Systems To Hacking

Companies using SAP AG’s business management software could be vulnerable to stealth attacks by hackers if their systems are not properly configured, according to a computer security expert.

The vulnerability could leave SAP’s customers open to sabotage, espionage and fraud through so-called backdoor attacks, said Mariano NuÑez Di Croce, Director of research and development with computer security firm Onapsis. The problem is significant because many of the world’s largest corporations use SAP’s software to handle accounting, manufacturing and other crucial tasks.

“In a typical default installation, anybody can connect to an SAP database, modify standard programs and do whatever they want without detection,” said Nuñez Di Croce, who will discuss the vulnerability next week at the Black Hat Europe computer security conference in Barcelona.

More from Biztech

Future Group - Reliance Retail Deal approved by CCI RBI ban on cryptocurrencies takes effect; prohibition could force investors to tap the black market

SAP, the world’s biggest maker of business management software, said that customers were only at risk of attack if they did not follow the company’s advice on how to protect their computer systems. “We believe that if customers follow our guidelines for security, the risk of illegitimate access through a backdoor can be excluded,” said SAP spokesman Saswato Das. The software maker builds several layers of security into its programs.

But Nuñez Di Croce said that hackers can bypass those safeguards by manipulating those programs through an attached database whose security settings are not properly set. Makers of databases that are most commonly used with SAP’s business management software include Oracle, Microsoft and International Business Machines. Once hackers gain access to an SAP system, they could install malicious programs to manipulate critical business processes or steal sensitive information, Nuñez Di Croce said.

Nunez Di Croce, whose company will release a free software tool to help companies protect against the threat, said he was not sure how frequently hackers had taken advantage of the vulnerability. (Reuters)