SAP Hana users warned of security vulnerability

Default encryption keys are the problem

SAP's S4/Hana at Sapphire Now 2015

SAP's S4/Hana at Sapphire Now 2015

Hard on the heels of the release of a newly updated version of SAP Hana, a security researcher has warned of a potentially serious vulnerability in the in-memory platform.

"If an attacker can exploit this vulnerability, he can get access to all encrypted data stored in an SAP Hana database," said Alexander Polyakov, CTO with ERPScan, which presented the details Thursday at the Black Hat Sessions XIII conference in the Netherlands.

Polyakov's firm specializes in testing enterprise resource planning (ERP) software from companies such as Oracle and SAP for security purposes. Last year, it had already found SAP Hana installations to be vulnerable to SQL injection attacks, he said.

More recently, "our goal was to understand if we can get access to more data and to other servers in the company," Polyakov explained.

What it found was that it was possible to get access to information such as user passwords and root keys because they were typically stored using the same default encryption key across Hana systems, giving potential hackers relatively easy access.

"The key is the same for every installation until the administrator changes it," Polyakov said. "After a couple of other penetration tests we found out that nobody was really changing this key."

The same issue exists on SAP mobile platforms, he added. Specifically, the application password stored in the configuration file was encrypted with the same default key in every installation.

At least one of the SQL injection vulnerabilities in Hana has already been patched, Polyakov said. In addition, SAP's own guidelines and security recommendations stipulate that the master key should be changed, Polyakov noted.

"Unfortunately, very few customers follow those recommendations," he said.

SAP works closely with external companies including ERPScan to ensure the security of its products, the company said in a statement.

"Our recommendation to all of our customers is to follow the advice in the SAP Hana Security Guide and change the static master keys that are issued with our products," it said.

If such problems exist in SAP's code, it's likely there's a similar issue in custom applications developed by third parties or by in-house developers "who are much less aware of secure development and can make more mistakes," Polyakov said.

It used to be common for software to use default passwords, he noted.

"Now we have a new problem: encryption keys with a default value," he said.

Eventually, Polyakov added, "vendors will give users the option to enter a security key during installation rather than putting somewhere in 160 pages of documents that the default key should be changed."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags applicationssecurityenterprise resource planningSAPsoftwareExploits / vulnerabilitiesData management

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Katherine Noyes

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?