Video: Tracking user transactions in SAP

SAP point-of-sale systems were totally hackable with $25 kit

Researchers able to hijack server and steal card details

Point-of-Sale systems from SAP had a vulnerability that allowed them to be hacked using a $25 Raspberry Pi or similar device, according to research unveiled at the Hack in the Box conference in Singapore last week.

Critical vulnerabilities in SAP's POS – since resolved – created a means for hackers not only to steal customers' card data but to gain unfettered control over the server, enabling them to change prices of goods with the help of a simple device, according to ERPScan.

SAP developed a patch after being alerted to the problem by ERPScan in April, allowing the enterprise app security specialists to go public with their discovery last week.

The root cause of the problem was that pre-patch SAP POS Xpress Server systems failed to perform any authentication checks for critical functionality that requires user identity. As a result, administrative and other privileged functions could be accessed without any authentication.

Read the full article at The Register.

SAP issues 26 patches to fix denial of service and SQL injection flaws | Computing

"Critical patch update fixes a total of 30 flaws in SAP’s ERP software - SAP has issued a series of 13 patches to fix security flaws exposing customers to the risk of denial of service attacks, cross-site scripting flaws and even a SQL injection flaw.

On top of that, SAP has also updated patches for 13 security flaws that were supposed to have been fixed in last month's SAP patch consignment. 

Other fixed flaws include two directory traversal vulnerabilities and two missing authorization check security flaws. According to ERPSsan, which specializes in analyzing ERP software for security flaws, 14 of the released SAP Security Notes have a ‘high priority' rating and one has what it calls a ‘Hot News' rating. It claims that 559 SAP servers worldwide are at risk of the denial of service vulnerability, with a cluster of vulnerable servers located in London and Ireland. Most, however, are located in India, the US or China." Read more...

Awareness Improving But Security Still Lags For SAP Implementations

By Ericka Chickowski "SAP ecosystem a huge Achilles heel for enterprise system security, report says. While SAP makes some of the most business-critical applications used by enterprises today, it has taken some time for the IT world to get serious about securing SAP infrastructure. In the wake of a several high-profile incidents involving SAP over the past year -- and an increasing focus by analysts on SAP defense issues -- SAP awareness is at an all-time high in 2016. But the statistics show that there's a lot of work to do in order to turn that awareness into meaningful protection for business-critical applications.

Uprotecting a program variant

Program variants can be protected in order to avoid unauthorized users from changing them. E.g. Variants are protected if they are part of a batch scheduling process that needs for them to remain consistent in order to maintain the integrity of the executing batch job. 

Protecting a Variant

TIP: Adding an authorization to a user using a function module

Note: Only recommended for Dev environments to test your authorizations and how they work for your programs...

Call function PRGN_INTERFACE_USER with the following parameters:

 

•  Profile: Authorization profile you need to add
• User: User to add the profile to
• Action: I = Insert, D = Delete
• Perform checks = <blank>

TIP: System trace for authorization checks

Use transaction STAUTHTRACE to trace a specific users interaction with authorization objects. The resulting display is a very useful ALV grid containing the authorization objects as well as the sub-objects and related activities checked.

SUIM to find Single Roles included in Composite roles

Question: How can I find the included single roles of a certain composite role? Answer: Call transaction SUIM, access the menu Roles -> By Role Name, type the name of the composite role and execute. Now you can click on the button Included Single Roles (CTRL+SHIFT+F12).


https://dbabasis.wordpress.com/2011/02/28/suim-to-find-single-roles-included-in-composite-roles/

PFCG – Authorization maintenance

This post demonstrate how you can use the transaction PFCG to create and maintain access to within SAP by creating Roles and Composite Roles. The main idea here is to create a role and make it part of a composite role to facilitate user and access administration.


https://dbabasis.wordpress.com/2015/02/27/pfcg-authorization-maintenance/

SAP Security and authorization: From concept to implementation

SAP authorization can be both straightforward and confusing at the same time. To make it easy to understand let’s put things this way: The SAP ERP is composed by ABAP programs, which have access groups and access objects, so in order to successfully access the programs a user must be granted the necessary authorization objects […]


https://dbabasis.wordpress.com/2015/03/13/sap-security-and-authorization-from-concept-to-implementation/