Stefan Mileschin

Mostly exploiting a failure to patch

At least a dozen companies and government agencies have been targeted, and thousands more are exposed to data breaches by hackers exploiting old security flaws in Oracle and SAP management software, two cybersecurity firms and Homeland Security have warned.

Systems at two government agencies and firms in the media, energy and finance sectors were hit after failing to install patches or take other security measures advised by Oracle or SAP, security firms Onapsis and Digital Shadows said in the newly published report.

The alarm was raised because firms store highly sensitive data – including financial results, manufacturing secrets and credit card numbers – in the vulnerable products, known as enterprise resource planning (ERP) software and in related applications for managing customers, employees and suppliers.

In an alert entitled “Malicious cyber activity targeting ERP applications”, the Homeland Security’s National Cybersecurity and Communications Integration Center highlighted signs of increasing hacker focus on ERP applications, citing the study.

“An attacker can exploit these vulnerabilities to obtain access to sensitive information”, said NCCIC, an arm of the U.S. Computer Emergency Readiness Team (US-CERT).

An SAP spokesman said that, in general, the company takes security issues seriously across its organisation.

“Our recommendation to all of our customers is to implement SAP security patches as soon as they are available - typically on the second Tuesday of every month - to protect SAP infrastructure from attacks."

Oracle did not say anything but both companies release regular patches to known security bugs in their software. However, customers are often reluctant to make fixes out of fear doing so might disrupt their manufacturing, sales or finance activities.

https://fudzilla.com/news/46824-sap-...ted-by-hackers