Week 10

A remote code execution (RCE) vulnerability in SAP GUI (Graphical User Interface) exposes unpatched systems to malware attacks such as ransomware, ERPScan security researchers warn.The flaw was discovered in December 2016, and SAP was informed on the issue the same month, yet a fix was released only as part of SAP’s March 2017 security updates. The flaw was found in SAP GUI for Windows 7.20 to 7.50, and was assessed with a High severity rating (a CVSS Base Score of 8.0).

SAP GUI is a platform that offers remote access to the SAP central server in a company network. To exploit the vulnerability and bypass SAP GUI security policy to execute the code, an attacker would have to use special ABAP (Advanced Business Application Programming) code.According to ERPScan, a company specialized in securing SAP and Oracle applications, the vulnerability could allow an attacker to “access arbitrary files and directories located in an SAP-server filesystem, including an application’s source code, configuration, and critical system files.” Actors could use the bug to obtain critical technical and business-related information stored in a vulnerable SAP-system.

SAP GUI has a rule which allows reading, writing, executing of regsvr32.exe Windows application without the security prompt.The security researchers also explain that regsvr32.exe can be used to load DLL files from a remote SMB share and execute DllMain function. To reproduce the flaw, one can compile a DLL file and upload it to a SMB share, create an ABAP program and replace the DllMain path to the share path, then execute the program.

I thought this article was interesting because it focused on the social aspect of security. It talks about how most people are not aware of suber security risks and they are not properly trained. The Article suggests that we have a dangerous mindset about cyber security and it can pose a huge threat. Despite all the recent major breaches in both the private and political sectors people have very little knowledge or self-awareness of the security implications. I think these are very good points and people are relying on technology to protect themselves from threats which leaves us very vulnerable to social threats.

http://www.slate.com/articles/technology/future_tense/2017/03/why_america_s_current_approach_to_cybersecurity_is_so_dangerous.html