SAP: It takes exploit devs 72 hours to turn our security patches into a weapon

Posted by arkadiyt on Tuesday April 06, 2021 @09:22PM
from the theregister.com dept.

https://www.theregister.com/2021/04/06/sap_patch_attacks/

( 8 comments | 24 points | on HN )

Re:SAP: It takes exploit devs 72 hours to turn our security ... by tru3_power on Wednesday April 07, 2021 @01:21AM (#26720859)

What is sap even written in? Never used it. If it’s a cloud app, why do sysadmins need to manually install patches? Wouldn’t this be pushed by sap themselves?

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by ToruiDev on Wednesday April 07, 2021 @01:41AM (#26720946)

SAP ERP is nowadays mostly written in C(++), java and ABAP (their own programming language to implement business logic, forms and reports) with SAP HANA bringing Web technologies.

SAP also predates the cloud, it used to be in mainframe land though (SAP R/2).

It has a cloud offering in its latest revision SAP HANA, but switching a major version is prohibitely expensive and requires immense amounts of work.

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by paxys on Wednesday April 07, 2021 @04:51AM (#26722016)

And what percentage of system administrators apply all patches within 72 hours of release? I'd be very surprised if it was higher than single digits.

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by gervwyk on Tuesday April 06, 2021 @11:38PM (#26720343)

This is really scary but hardly surprising!

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by tonyedgecombe on Wednesday April 07, 2021 @07:45AM (#26723429)

Yet more pressure to move to SaaS (which is probably why SAP are happy to disclose this).

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by throwaway189262 on Wednesday April 07, 2021 @12:27AM (#26720600)

Obligatory SAP is terrible. I wouldn't wish it on my worst enemy

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by tonyedgecombe on Wednesday April 07, 2021 @07:44AM (#26723420)

SAP is a magic money tree for those that know it well.

[ Parent | on HN ]

Re:SAP: It takes exploit devs 72 hours to turn our security ... by throwaway189262 on Thursday April 08, 2021 @05:12AM (#26736679)

I don't want to become rich off of other people's suffering

[ Parent | on HN ]