Presentation Title SAPocalypse Now: Crushing SAP’s J2EE Engine
Presentation Abstract

Having had great success with the first part of our research “A crushing blow at the heart of SAP’s J2EE Engine” this is a continuation in this series of presentations and will look deeper at new web-based attacks and post exploitations on SAP’s J2EE applications.

We will explain the architecture of SAP’s J2EE engine and give a complete tour into its internals. Thereafter, we will show a number of previously unknown architecture and program vulnerabilities from auth bypasses, smbrelays, internal scans, XML/SOAP attacks to insecure encryption algorithms and cross-system vulnerabilities in the J2EE platform. Finally a chained attack which use multiple logic vulnerabilities that gives full control over SAP’s J2EE Engine will be demoed. A free tool will also be presented to automatically scan custom applications against this attack.

Will this attack concept lead to a new worm? Who knows, but be prepared for SAPocalypsis NOW!

About Alexander Polyakov

Alexander Polyakov is the CTO at ERPScan company. Head of DSecrG research center (department of ERPScan). His expertise covers enterprise business-critical software like ERP, CRM, SRM, RDBMS, SCADA, banking and processing software. He found a lot of vulnerabilities in the products of such vendors as SAP and Oracle, and has made a lot of projects focused on special applications security in oil and gas, retail and banking sphere. He is the author of a book titled “Oracle Security from the Eye of the Auditor:Attack and Defense (in Russian).” He is also lead a OWASP-EAS, architect of ERPSCAN Security Scanner for SAP (http://erpscan.com), one of the contributors to Oracle with Metasploit project. Speaker at HITB (EU/ASIA), BlackHat, Source, DeepSec, Confidence, Troopers and many Russian conferences.

About Dimitry Chastuhin

Dimitry Chastuhin is a student of St. Petersburg State Polytechnic University, computer science department, he works upon SAP security, particularly upon Web applications and JAVA systems. He has official acknowledgements from SAP for the vulnerabilities found. Dmitriy is also a WEB 2.0 and social network security geek who found several critical bugs in Vkontakte (vk.com) and Yandex.ru, the Russian largest social networks and search engines. He is a contributor to the OWASP-EAS project.