WIXLIB

SIS203SAP Runs SAP – Remote Function Call: Gateway Hackingand DefenseThis presentation describes experiences gained in real-life implementation of RFC gateway* protection at SAPBjoern Brencher / SAP Global IT – Security & Risk OfficeSAP TechEd 2012* RFC gateway is a technical component in the SAPkernel. It is not the product SAP NetWeaver Gateway.

DisclaimerThis presentation outlines our general product direction and should not be relied on in making apurchase decision. This presentation is not subject to your license agreement or any other agreementwith SAP. SAP has no obligation to pursue any course of business outlined in this presentation or todevelop or release any functionality mentioned in this presentation. This presentation and SAP'sstrategy and possible future developments are subject to change and may be changed by SAP at anytime for any reason without notice. This document is provided without a warranty of any kind, eitherexpress or implied, including but not limited to, the implied warranties of merchantability, fitness for aparticular purpose, or non-infringement. SAP assumes no responsibility for errors or omissions in thisdocument, except if such damages were caused by SAP intentionally or grossly negligent.This presentation describes and reflects experiences gathered during the real-life implementation ofthe RFC gateway protection in systems at the company SAP. Some information presented issimplified. Implementation in systems at other companies may require additional steps. 2012 SAP AG. All rights reserved.2

AbstractFor the first time, SAP’s own internal security department will provide insight into the SAP internalproject of how to secure remote function call (RFC) communication via the “gateway” component. RFCis one of the main communication technologies for SAP NetWeaver-based systems. RFC is handledby gateway, which is a technical component running on every SAP NetWeaver Application Server –ABAP and Java. Gateway access control is one of the most crucial security configurations in SAPNetWeaver systems. After demonstrating how to break into SAP systems that lack gateway accesscontrol, you will learn how to design access control for highly integrated and connected SAPlandscapes and how to implement it without business disruption. In addition, a monitoring strategy forgateway security will be presented. 2012 SAP AG. All rights reserved.3

AgendaHackers & RFC gatewayLive hacking demo – exploiting insecure RFC gateway configurationsSAP Runs SAP: How do we secure the RFC gateway? 2012 SAP AG. All rights reserved.4

Hackers & RFC gateway

Is your SAP environment secure?Standard usersSecurity notesAuthorizationsFirewallsWeb contentEncryptionRFC gateway** RFC gateway is a technical component in the SAPkernel. It is not the product SAP NetWeaver Gateway. 2012 SAP AG. All rights reserved.6

Vulnerabilities of RFC gateway disclosed on security conference2007 2012 SAP AG. All rights reserved.Security conference – Blackhat USA Mariano Nuñez Di Croce –Attacking the Giants: Exploiting SAP Internals7

SAP Runs SAP: What we did to protect our own systems at SAP2007Task force initiated with SAP Product Development Evaluate the security issue with SAP ProductDevelopment and the external researcher Analyze and discuss protection possibilities asprotection is only possible by configuration2008SAP internal project started Define protection of the RFC gateway for our ownSAP business systems Run pilot implementation for 1 system landscape Rollout to all critical landscapes Define monitoring procedure 2012 SAP AG. All rights reserved.8

More presentations about the same RFC gateway vulnerabilities2007Security conference – Blackhat USA Mariano Nuñez Di Croce –Attacking the Giants: Exploiting SAP Internals2010Security conference – 27C3, the 27th. Chaos Communication Congress Ertunga Arsal – Rootkits and Trojans On Your SAP Landscape2012Security conference – CRESTCon Dave Hartley – SAP SlappingSecurity conference – Troopers Mariano Nuñez Di Croce – Real-World Cyber Threats to SAP Systems Ralf Kempf – SAP Solution Manager from the hackers point of view 2012 SAP AG. All rights reserved.9

Protection of RFC gateways at SAP customersChallenges for SAP Customers Protection requires configuration on customer side Very technical topic with high complexity Elaborate implementation of security measuresImprovements by SAP (supported by our implementationexperience) Reduced implementation times of security measures Improved documentation on vulnerability and security measures Secure default configuration of RFC gateways as of SAP NetWeaverApplication Server ABAP 7.31SAP customers need to secure their RFC gateways 2012 SAP AG. All rights reserved.10

What is the RFC gateway? – Quick introduction – Part 1SAP NetWeaverApplication Server ABAPSAP NetWeaverApplication Server ABAP1SAP GUIDatabaseWorkprocessesRFCgatewaydisp workgwrdScenarios of RFC communication1 Call to ABAP function modules1. 2012 SAP AG. All rights reserved.11

What is the RFC gateway? – Quick introduction – Part 2SAP NetWeaverApplication Server ABAPSAP GUISAP NetWeaverApplication Server ABAP1DatabaseWorkprocessesRFCgatewaydisp workgwrd2Start operatingsystemcommandsScenarios of RFC communication1 Call to ABAP function modules1.2 RFC call to start operating system commands, e.g. tp, sapxpg2. 2012 SAP AG. All rights reserved.12

What is the RFC gateway? – Quick introduction – Part 3SAP NetWeaverApplication Server ABAPSAP GUISAP NetWeaverApplication Server ABAP1DatabaseWorkprocessesRFCgatewaydisp work3gwrd2Start operatingsystemcommands3rd party RFC server(Database Monitor)ServerScenarios of RFC communication31 Call to ABAP function modules1.2 RFC call to start operating system commands, e.g. tp, sapxpg2.3 RFC calls to register and use external RFC servers3. 2012 SAP AG. All rights reserved.SAP and 3rd partyRFC server(e.g. SWIFT Payment,SAP NetWeaverEnterprise Search)13

Live hacking demo – exploitinginsecure RFC gatewayconfigurations

Let’s hack the SAP system misusing the RFC gatewayAttack scenarioConnect to the RFC gateway andexecute operating systemcommands (e.g. createSAP ALL user with SQL client)SAP NetWeaverApplication Server ABAPSAP RFC SDKSAP NetWeaverApplication Server ABAPDatabaseWorkprocessesRFCgatewaydisp workgwrdStart operatingsystemcommandsSAP JCoCommercial Tools 2012 SAP AG. All rights reserved.15

Impact of unprotected RFC gatewayRisk and impact of an unprotected RFC gateway Full control over SAP systems bypassing any other SAP security controls Manipulation of data which endangers legal compliance Data theft No traceability due to missing audit trail Unavailability of data and systemsUnprotected RFC gateways allow manipulation of business processes in SAP systems 2012 SAP AG. All rights reserved.16

Protection of the RFC gateway – secinfo and reginfoRFC gateway protection Secinfo: Allow only authorized systems to execute operating system commands Reginfo: Allow only authorized systems to register RFC serversSAP NetWeaverApplication Server ABAPSAP NetWeaverApplication Server ABAPSAP RFC SDKWorkprocessessecinfoSAP JCoCommercial Tools 2012 SAP AG. All rights reserved.disp workRFCgatewaygwrdreginfo17

Protection in detail – started RFC server (secinfo)File on operating system (defined by gw/sec info) with a list of entries likeUSER *, USER-HOST source , HOST destination , TP *System that wants to startthe program (source system)User that wants tostart the programsecinfoName of the programto be startedSystem where the program shouldbe started (destination system)Useful variables for USER-HOST and HOST local – All local interfaces of 1 application server internal – All interfaces of all application / database servers belonging to the same SAPsystem 2012 SAP AG. All rights reserved.18

Protection in detail – registered RFC server (reginfo)File on operating system (defined by gw/reg info) with a list of entries likeTP *, HOST source Name of the programto be startedreginfoSystem that wants to startthe program (source system)Useful variables for HOST local – All local interfaces of 1 application server internal – All interfaces of all application / database servers belonging to the same SAPsystem 2012 SAP AG. All rights reserved.19

RFC gateway protection – Where to find the settings?In SAP NetWeaver Application Server ABAP, display settings of RFC gateway protection Transaction SMGW – Expert FunctionsExternal Security– Display (Sec Info)– Display (Reg. Info)– Create (secinfo)– Create(reginfo)– Read Again– Reread (global) Change of secinfo & reginfo content hasto be done on operating system level 2012 SAP AG. All rights reserved.20

SAP Runs SAP: How do wesecure the RFC gateway?

The Challenge! – Find the right entriesSAP NetWeaverApplication Server ABAPWorkprocessesHow to identify systemsthat need to be added?secinfodisp workRFCgatewaygwrdreginfo 2012 SAP AG. All rights reserved.22

SAP Runs SAP: Protection in detail – started RFC server (secinfo)Recommended entriesSAP system (e.g. PRD) Allow local application server trafficsecinfoUSER * USER-HOST local HOST local TP * Allow traffic between all application serversand the database server of an SAP systemSAP system (e.g. PRD)USER * USER-HOST internal HOST internal TP *According to our experience at SAP thiscovers about 99% of all secinfo traffic! 2012 SAP AG. All rights reserved.23

SAP Runs SAP: Protection in detail – registered RFC server (reginfo)Recommended entriesSAP system (e.g. PRD) Allow registration of RFC servers between allapplication servers and the database serverreginfoTP *, HOST localTP *, HOST internalThe Challenge! Additional customer specific entries Allow registration of RFC servers from requiredsystems for 3rd party software integration, e.g.TP *, HOST search.demo.sap.corpTP *, HOST payment.demo.sap.corpTP *, HOST 10.2.4.2TP *, HOST Unknown system 2012 SAP AG. All rights reserved.SAP NetWeaverEnterprise SearchSAP NetWeaverPortalUnknownsystemSAP system (e.g. PRD)3rd Party SWIFTPayment24

SAP Runs SAP: How to implement RFC gateway protection?Prerequisite: Use the highest SAP kernel patch level as lots of things were improved and bugs fixedOriginal way:Low business risk, but huge effortAdditional way:More business risk, but less effort Activate logging of RFC gatewayAnalyze logsCreate secinfo & reginfo files manuallyActivate secinfo & reginfoUse creation reports for initial secinfo & reginfoActivate proposed secinfo & reginfoMonitor logs for rejected connections closelyAdd rejected entries to secinfo & reginfo manuallyWith SAP kernel 7.21: Introduction of simulation mode 2012 SAP AG. All rights reserved.25

SAP Runs SAP: Internal implementation of RFC gateway protectionScope of our SAP internal implementation Business critical systems of SAP (e.g. SAP’s own SAP ERP system) About 40 productive landscapes with roughly 200 single systemsTimelines of our SAP internal implementation In 2007, start with first analysis of RFC gateway protection In 2008, first pilot implementation By end of 2009, rollout completed to productive landscapesFurther Details of our SAP internal implementation Our project staffing: SAP Global IT Security & Risk Office with Basis Administratorsand a close link to SAP Product Development Our implementation was done with log analysis, as other ways were not available Implementation effort for rollout: 200 person days ( 5 person days per landscape) Estimated ongoing maintenance effort: 0.25 person day per year per landscape 2012 SAP AG. All rights reserved.26