Anti-SAP hacking software gets refresh

Sapyto, a tool to test the security of SAP systems, has been upgraded with new plugins that allow more thorough testing, according to the tool's developer.

Version 0.99 of Sapyto now runs on PCs running Microsoft Windows where the previous version ran only on Linux, said Mariano Nuñez Di Croce, senior security researcher with Cybsec Security Systems, a security company based in Buenos Aires, Argentina. He gave a presentation last week at the Black Hat security conference in Amsterdam.

The latest version of Sapyto adds new plugins that can be used to get information from remote SAP routers as well as automatically discover and then test remote SAP systems. Developers can also create their own plugins.

German software developer SAP makes business software systems that manage supply chains, finance issues and customer relationship management tasks, among many other things. The company has more than 40,000 customers around the world, and there are more than 120,000 SAP implementations, according to Nuñez Di Croce's presentation.

SAP systems have been targeted by hackers and insiders seeking to damage a company since the software contains valuable internal information. The incidents typically never become public because companies don't reveal them, Nuñez Di Croce said.

But it does happen. Nuñez Di Croce knows of a case two years ago where a company lost $250,000 (£170,000) due to the improper manipulation of an SAP finance system.

Some CFOs are still not cognizant of how important good security is on SAP systems, Nuñez Di Croce said. Since SAP systems are very expensive and control a vast amount of business processes, executives will press ahead with putting the systems into production without a proper security review, he said.

Nuñez Di Croce knew of another case where an executive decided to just have open access to an SAP system for three months. That's dangerous, and it's unlikely that after three months the system would be locked down, he said. Many SAP systems are simply left in the default security configurations, which is also unsafe, he said.

"Security is usually seen as a block in the road," Nuñez Di Croce. "There are many SAP systems running out there by major companies that are not secure."

Sapyto is open-source software and is free. It can be downloaded from Cybsec's website. Version 0.98 is on the Web site now, and the new version should be posted soon. Sapyto was the first penetration testing network built for SAP software.