SAP, Credit Cards, and the Bird that Talks Too Much
summary
Demonstrates real remote code execution via third‑party add‑ons (example: OpenText) to reactivate admin accounts and alter vendor bank details for large payments; claims password weaknesses let attackers recover 20–25% of business user passwords without policies (down to ~8% with policies). Shows a HTTP/RFC extractor called the subSucker tool that pulls card data from 50+ database tables, and even a proof‑of‑concept tweets BTM that successfully posts card numbers to Twitter. Detection and automated landscape‑wide controls are the recommended fixes.
AI-written summary · about
chapters (19)
- 0:00Start
- 3:41Attacking the Core
- 4:39Attack Vectors
- 10:03How can it be attacked?
- 16:15What is a Business Process?
- 17:31Example: Attacking the Business Processes
- 18:48Determining Victim Bank Accounts
- 20:23Changing the Bank Accounts
- 23:38Credit Card Processing on SAP
- 25:36Accessing Cleartext Cardholder Information
- 27:14Free Tool? - Sapsucker
- 28:13Decrypting Encrypted Credit Card Numbers
- 29:01Are we the only ones?
- 31:01External Vendors for Payment Solutions
- 31:44Standard Concept
- 32:44External Payment Card Interface Connectivity
- 34:24Further Security Issues
- 35:59Connecting SAP to Social Media
- 41:11Implement a Holistic Process to Stay Secure
related talks
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
01h 01mSomething Something Cyber
56mBlended Web and Database Attacks on Real-Time, In-Memory Platforms
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
51mMaking the most of Security Tests
27mCommon Application Security Mistakes that Enable Automated Attacks
56mHacking your Mind and Emotions