HoneySAP Who really wants your money? M ARTIN G ALLO M ARCH 2015 P - - PowerPoint PPT Presentation

▶

Mar 19, 2023 283 likes •750 views

HoneySAP Who really wants your money? M ARTIN G ALLO M ARCH 2015 P A G E AGENDA SAP SAP security Threat landscape Have Needs Honeypots HoneySAP Approach Goal Design Architecture Services Integration Example profiles Demo

SLIDE 1

P A G E

HoneySAP

Who really wants your

money?

MARTIN GALLO

MARCH 2015

SLIDE 2

P A G E 2

AGENDA

SAP SAP security Threat landscape Have Needs Honeypots HoneySAP Approach Goal Design Architecture Services Integration Example profiles Demo Challenges Call to contributions Conclusions

SLIDE 3

P A G E 3

WHAT IS SAP?

software company business processes critical systems $$$

SLIDE 4

P A G E 4

SECURITY IN SAP?

specialized skills commitment risk culture $$$

SLIDE 5

P A G E 5

SECURITY IN SAP?

focus on users, roles, SoD GRC platforms manual test tools automated test tools

SLIDE 6

P A G E 6

THREATS IN SAP?

complexity customization lack of knowledge business dynamics

SLIDE 7

P A G E 7

THREATS IN SAP?

fraud espionage sabotage insider & outsider

SLIDE 8

P A G E 8 P A G E

Targeted attacks Broad attacks

known for years traditional attacks targets not disclosing data now started appearing in media more recent malware looking for SAP entry point for targeted attacks

SLIDE 9

P A G E 9

Targeted

attacks

Broad

Attacks

THREATS LANDSCAPE

SLIDE 10

P A G E 1 0

some knowledge distributed weak defenses

WHAT DO WE HAVE?

SLIDE 11

P A G E 1 1

learn share act

WHAT DO WE NEED?

SLIDE 12

P A G E 1 2

MEET

Honeypots

SLIDE 13

P A G E 1 3

HONEYPOTS

types goals implementations

SLIDE 14

P A G E 1 4

HONEYPOTS

interaction

high / medium / low

purpose

research / production

SLIDE 15

P A G E 1 5

HONEYPOTS

gather information catch malware deceit/distract …

SLIDE 16

P A G E 1 6

HONEYPOTS

SLIDE 17

P A G E 1 7

MEET

HoneySAP

SLIDE 18

P A G E 1 8

APPROACH

low-interaction research centric

pen source

SLIDE 19

P A G E 1 9

GOALS

specific purpose identify behavior flexibility agility

SLIDE 20

P A G E 2 0

DESIGN

extendible

add services add feeds

SLIDE 21

P A G E 2 1

DESIGN

modular

dynamic loader services, feeds & datastore

SLIDE 22

P A G E 2 2

DESIGN

easy to configure

JSON & YAML default profiles

SLIDE 23

P A G E 2 3

DESIGN

easy to deploy

vagrant + ansible docker?

SLIDE 24

P A G E 2 4

ARCHITECTURE

CORE SERVICES

SERVICE MANAGER SESSION MANAGER FEED MANAGER LOGGER LOADER CONFIG

FEEDS

DB HPFEEDS FILE

LIBS

SAP ROUTER MESSAGE SERVER GEVENT PYSAP FLASK

CONSOLE

DATASTORE DATASTORE MANAGER ICM ..

SLIDE 25

P A G E 2 5

ARCHITECTURE

SERVICES

SAP ROUTER ICM MESSAGE SERVER GATEWAY .. DATA STORE

SLIDE 26

P A G E 2 6

HTTP-based services PySAP-based services

ROUTER MESSAGE SERVER DISPATCHER GATEWAY

P A G E

.. ICM MESSAGE SERVER WEB DISPATCHER NW GATEWAY ..

SLIDE 27

P A G E 2 7

SERVICES

virtual services

don’t bind to real addresses allows routing/dispatching

SLIDE 28

P A G E 2 8

SERVICES

forwarder service

forwards traffic to ext. services can be run as a virtual service

SLIDE 29

P A G E 2 9

INTEGRATION

honeypots

routing/dispatching, honeynets, deployment

actual systems

routing/dispatching

SLIDE 30

P A G E 3 0

INTEGRATION

standard feeds

hpfeeds, taxii, stix

..

SLIDE 31

P A G E

HoneySAP

3 1

EXAMPLE PROFILE

SAPRouter service THE INTERNET ADVERSARY

Kippo (SSH) Dionaea (smb, ftp, mysql, etc.) SAP internal virtual services (gateway, dispatcher, ms, icm, etc.)

1) identifies the service 3) requests route to internally served virtual services 4) requests route to other exposed honeypots 2) discovers

pen routes

SLIDE 32

P A G E 3 2

EXAMPLE PROFILE

THE INTERNET ADVERSARY SAP ICM service

SAP internal ICF services (ping, SOAP RFC, etc.)

HoneySAP 1) identifies the service 2) scans for exposed ICF services 3) access ICF services

SLIDE 33

P A G E 3 3

EXAMPLE PROFILE

INTERNAL NETWORK SAP ICM service ADVERSARY

SAP internal ICF services (ping, SOAP RFC, etc.)

HoneySAP

SAP internal virtual services (gateway, dispatcher, ms, etc.)

1) identifies the services 2) access the services

SLIDE 34

P A G E 3 4

DEMO TIME

SLIDE 35

P A G E 3 5

CHALLENGES

core development

modular structure gevent + scapy/flask

SLIDE 36

P A G E 3 6

CHALLENGES

+ knowledge on each service

packets not enough behavior

SLIDE 37

P A G E 3 7

CHALLENGES

detection non-standard behavior

error messages http services

SLIDE 38

P A G E 3 8

CHALLENGES

performance?

not sure yet

SLIDE 39

P A G E 3 9

CHALLENGES

what to log? determine IoA/IoC

SLIDE 40

P A G E 4 0

CHALLENGES

deployments

make it easier to deploy integration

SLIDE 41

P A G E 4 1

CALL FOR CONTRIBUTIONS

run, test, patch, submit collect & analyze extend

SLIDE 42

P A G E 4 2

CALL FOR CONTRIBUTIONS

grab it soon from

https://github.com/CoreSecurity/ http://corelabs.coresecurity.com/

GPLv2 license working on data feed

SLIDE 43

P A G E 4 3

CONCLUSIONS

more knowledge about services new source of attacks info

diff. approach for defense

SLIDE 44

P A G E 4 4

Q&A

???

SLIDE 45

P A G E 4 5

THANK YOU !

mgallo@coresecurity.com @martingalloar