What network protocols does my SAP system use? Are those services secure from a network perspective? Are old and well-known attacks still relevant? What’s the remote attack surface of my SAP environment? Do I really know my level of exposure? Are there tools available to assess the security of the services? This talk is the result of my journey trying to answer these questions and understanding how the different SAP network protocols work, after spending some of my spare time during the last months working on expanding my knowledge about the network attack surface of SAP systems, reversing some of the protocols and implementing tools and libraries to work with them. The talk will bring some details and realistic attack vectors regarding the different networks protocols available on both new and classic SAP installations. Some hardening and mitigation ideas will be discussed aimed at increasing the defenses against these threats and attacks.
Martin Gallo is Penetration Testing SME at Core Security, where he applies his experience on penetration testing, code reviews and vulnerabilities hunting to the continuous improvement of the company's services and products. His research interests include enterprise software security, vulnerability research, threat modeling and reverse engineering. Martin has given talks at Troopers, Brucon and Defcon conferences.