Search

Threat Intelligence and Blog Overview Page

Blog Research

10/02/2024

Assessing Your SAP Implementation: Tips from Onapsis Research Labs

Learn how the S_ICF authorization object in SAP ABAP systems enhances security by restricting access to RFC destinations,...
09/04/2024Fabian Hagg

Securing SAP Remote Function Calls: The Crucial Role of S_ICF Authorization

Learn how the S_ICF authorization object in SAP ABAP systems enhances security by restricting access to RFC destinations,...
08/01/2024

Ransomware Attacks on SAP: Key Insights from Our Fireside Chat with Turnkey

SAP systems have experienced a 400% increase in ransomware threats since 2021. This staggering statistic, reported by Onapsis and...
Executive Perspective with Mariano Nunez
04/17/2024Mariano Nunez

New Threat Intelligence: Threat Actors Targeting SAP for Profit

Gain insights into the top questions that CIOs & CISOs should be asking about SAP security and vulnerabilities.
Paul Laudanski
03/14/2024Paul Laudanski

Echoes of Deception: Unmasking the New Wave of AI-Generated Robocall Frauds

The digital landscape is constantly evolving, and unfortunately, so are the tactics of scammers. In a recent landmark decision,...
Paul Laudanski
02/07/2024Paul Laudanski

Safeguarding Your Digital World: Strategies to Counter Nation-State Actors

Explore Molerat's advanced phishing tactics and the vital role of updated threat intelligence, machine learning, and vigilance...
10/16/2023

More Aggressive Time-to-Exploit Vulnerability Trends Affect Oracle and SAP Security Too

On September 28th, Mandiant published their Time-To-Exploit trends report, including several very insightful stats covering...
10/04/2023Pablo Artuso

Available Now: Java Endpoint Analyzer from Onapsis Research Labs

Onapsis Research Labs launched a new Java Endpoint Analyzer to the community to help identify SAP endpoints.
07/11/2023

Return of the ICMAD: Critical Vulnerabilities Affecting ICM over HTTP/2

In 2023, the cybersecurity landscape has seen the return of ICMAD. Learn more about the two vulnerabilities and if your company...
04/11/2023

P4CHAINS Vulnerabilities

Onapsis reviews the p4chains vulnerability and how vulnerability changing plays a role in this family of vulnerabilities...
01/05/2023Thomas Fritsch

A Look Back at SAP Vulnerabilities in 2022

Onapsis Research Labs shares some of the top SAP security vulnerabilities organizations should be aware of from 2022.
12/06/2022Thomas Fritsch

The Risks of SAP RFC Callbacks and How to Avoid Them

This blog explains SAP RFC Callbacks and how to protect your SAP systems.
12/05/2022Thomas Fritsch

Protect SAP Systems With Unified Connectivity Framework (UCON)

This blog post will explain the main aspects of Unified Connectivity Framework (UCON) and how it can be used to decrease...
12/02/2022Onapsis Research Labs

AppsMas: A Look Back at the 2022 ERP Security Landscape (Video)

Let’s take a look back at the 2022 ERP Security Landscape and what we can learn from it.
11/30/2022Thomas Fritsch

SAP Development System: A Critical Entry Point for Attacks

SAP development systems are an often underestimated entry point for attacks.
11/02/2022Onapsis Research Labs

Onapsis Research Labs Discovers and Helps Remediate 1,000+ Cybersecurity Vulnerabilities in Business Applications

Onapsis Research Labs, our team of offensive security professionals dedicated to hunting down vulnerabilities within ERP...
10/26/2022Onapsis Research Labs

Threat Actors Exploit ERP Vulnerabilities for Financial Gain

Threat actors are exploiting ERP vulnerabilities for financial gain.
10/19/2022Thomas Fritsch

Password Hash Cracking, User Cloning, and User Impersonation: Three Risks Every SAP Customer Should Know

Password hash cracking, user cloning, and user impersonation are realistic attack scenarios in SAP systems. This blog post...
10/14/2022Onapsis Research Labs

Unpatched ERP Vulnerabilities Haunt Organizations

What's spookier than ghosts and goblins? Threats to your company's ERP systems. Read how unpatched ERP vulnerabilities can...
08/22/2022Onapsis Research Labs

ICMAD Vulnerability Added to CISA’s Known Exploited Vulnerabilities Catalog

On August 18, 2022 the US Cybersecurity and Infrastructure Security Agency (CISA) added a critical SAP vulnerability–CVE-2022-22536–to...
06/09/2022

Three Actively Exploited SAP Vulnerabilities Identified by Onapsis Research Labs: What You Need to Know

The Onapsis Research Labs detected active exploitation activity related to three vulnerabilities that were already patched...
04/28/2022Mariano Nunez

Onapsis and SAP Partner to Secure Business

Despite their importance, many organizations lack the proper preventative, detective, and corrective controls to secure a...
04/27/2022Onapsis Research Labs

Attack & Secure SAP Systems with Onapsis Research Labs at Troopers Conference

Join Onapsis Research Labs at Troopers Conference for the fundamentals of how to pentest and secure SAP systems. Students...
04/25/2022Maaya Alagappan

Meet the Researcher: Ignacio Favro

Get to know Ignacio Favro, a vulnerability security researcher in Onapsis Research Labs.
04/12/2022Maaya Alagappan

An Introduction to The Onapsis Research Labs

Onapsis is the only business-critical application security company that automatically updates products with the latest threat...
02/25/2022Onapsis Research Labs

How Does HTTP Response Smuggling Work

Research from the Onapsis Research Labs in HTTP Response Smuggling led to the discovery of a set of critical vulnerabilities...
02/08/2022

ICMAD: Critical Vulnerabilities in SAP Business Applications Require Immediate Attention

Onapsis Research Labs discovered a set of extremely critical vulnerabilities affecting SAP applications actively using the...
01/10/2022

The Elephant Beetle in the Room: Older, Unpatched SAP Vulnerabilities Are Still A Threat

Threat group 'Elephant Beetle' exploited two SAP vulnerabilities to steal millions of dollars from financial organizations....
12/20/2021Onapsis Research Labs

Log4j Vulnerability & The Impact on SAP Applications

Onapsis Research Labs shares data and threat intelligence surrounding Log4j vulnerability, SAP security, and SAP applica...
11/23/2021Onapsis Research Labs

Salesforce Security Auditing: An Overview - Login History

In this blog series, Onapsis Research Labs will introduce you to the different types of audit capabilities that Salesforce...
08/13/2021Onapsis Research Labs

Black Hat 2021: Onapsis Research Labs Shares Learnings

Onapsis Research Labs shares their experiences and learnings from their SAP training session at Black Hat 2021.
07/01/2021Onapsis Research Labs

Salesforce Aura: Potential Vulnerabilities in the ‘Without Sharing’ Annotation

The Salesforce Winter ‘21 patch for Aura should remediate the security risk that allowed any authenticated user the ability...
10/16/2020

Introducing SAP Management Console: Concepts and General Considerations

The SAP Management Console (SAP MC) provides a common framework for centralized system management. It allows you to monitor...
02/18/2020Onapsis Research Labs

Is Enabling the SSL Connection to Your Java System Enough?

Secure Sockets Layer (SSL)/Transport Layer Security (TLS) is a protocol used to encrypt communications between two entities...
01/31/2020Thomas Fritsch

SAP Security Notes: Looking Back at 2019 and Forward to 2020

There is no doubt that ERP systems will increasingly become a preferred target of cyberattacks. SAP and Onapsis have taken...
07/27/2019Onapsis Research Labs

ERP Security & IT General Controls: Questions Every Organization Needs to Ask

A recent IDC survey reports that 64% of organizations have suffered an ERP system breach in the past 24 months. To ensure...
06/27/2019

Securing Your Business Applications: Are You Prepared?

Have you ever gotten a puzzled look from friends/family when you tell them you help secure ERP systems? I know, that’s...
06/06/2019Sergio Abraham

Automating SOX Controls Testing

With ERP systems, such as SAP and the Oracle E-Business Suite (EBS) at the core of your business, these systems also must...
05/23/2019

Paving Your Way Through SAP Digital Transformation Part 3

In this blog post, we will discuss how you can make security and compliance an enabler rather than see it as a roadblock...
04/03/2019

5 Takeaways From Troopers Conference 2019

The Onapsis Research Labs were in attendance for the 2019 edition of Troopers Conference - hear from our Head of Research...
02/15/2019Laura Cabrera

Securing Clients in SAP S/4HANA and Netweaver ABAP

Our latest technical blog from the Onapsis Research Labs provides details about securing SAP clients.
11/05/2018

Restrict the File Types Uploaded to Your EBS Application

When it comes to Oracle EBS security, there are many steps to take to proactively protect your organization. Restricting...
10/17/2018Matias Sena

Oracle Patches 301 Vulnerabilities in October 2018 CPU

Our quarterly analysis of the Oracle CPU for October 2018. This time, half of the vulnerabilities this quarter have a direct...
07/30/2018

How Do You Check Old Hashes in Your ABAP System?

Learn how to further protect your SAP systems by checking if your ABAP systems contains stored insecure hashes.
07/17/2018

New Record, Oracle Fixes 334 Vulnerabilities in July 2018 CPU

Includes a step-by-step CPU implementation guide for Oracle E-Business Suite.
05/04/2018

Beware the Silent Threat of Insecure Configurations to Your SAP Systems

Our research team recently revealed a critical threat to SAP Netweaver - Join our upcoming webcast to learn more.
02/22/2018Daniel Antonelli

SAP Security: Table Change Logging and Security Considerations

The goal of this blog post is to help you understand the importance of enabling the Table Change Logging in your SAP system...
01/17/2018

Oracle January CPU Analysis: 64% of Patches Affect Business-Critical Applications

Onapsis confirms public exploit attacking Oracle applications can affect Oracle E-Business Suite
10/17/2017Matias Sena

Oracle October CPU: Onapsis Contributes to EBS Security by Reporting Almost 60% of the Vulnerabilities, Including Those Most Critical

One of the most important components of securing business-critical applications is to ensure the systems are always up to...
09/21/2017Waldo Spek

GDPR and SAP: Will it Affect You and What Steps You Can Take Now

At Onapsis we recognize that information security means more than just protecting your business-critical applications from...
09/14/2017Matias Sena

Onapsis Research Labs Releases First Oracle Security In-Depth Publication

At Onapsis we are dedicated to continuously improving security in business-critical applications. Today Onapsis Research...
09/06/2017

Analysis of the SAP HANA Internal Communication Interface

SAP HANA is a very fast growing product in many SAP environments, that has moved away from just an in-memory database to...
08/24/2017Onapsis Research Labs

Protecting Oracle E-Business Suite: Encrypt Web Interface (HTTPS)

To keep our readers informed about security risks and mitigation techniques to Oracle’s biggest ERP, E-Business Suite (EBS),...
08/18/2017Daniel Antonelli

TMSADM User with Default Password: Another Risk in Your SAP System

What the SAP security implications of having TMSADM enabled with default passwords and how can you properly protect it?
07/06/2017

Protecting Oracle E-Business Suite: Reducing the Attack Surface

This is the fourth consecutive blog post in our series on how to make Oracle E-Business Suite more secure. In this post,...
06/29/2017

Protecting Oracle E-Business Suite: Password Policy

For a third week, we’re providing you with best practices for securing your Oracle E-Business Suite implementation....
05/15/2017Pablo Artuso

How to know if your SAP systems are affected by WannaCry

Implement newly released SAP Security Note: 2473454 to confirm your SAP systems are protected.
04/13/2017Alex Horan

How the Proposed OWASP TOP 10 Changes Would Affect SAP and Oracle

While only in release candidate form, the current proposed changes to the OWASP Top 10 Application Security Risks provide...
01/17/2017

Oracle CPU for January 2017 Breaks New Record

In this month’s post we will analyze the January 2017 Oracle Critical Patch Update (CPU) and how it relates to Oracle...
01/12/2017

Announcing the Onapsis SAP HANA Security Resource Center

SAP HANA evolved a lot in 2016, as did security focused on this critical platform. The year ended with the release of the...
01/10/2017

SAP Security Notes January 2017: Continued Security Focus on SAP for Defense

So, 2017 begins… and the first Patch Day has arrived. Today, SAP published its first Security Notes post of the year,...
10/04/2016Julián Rapisardi

Moving SAP to the Cloud? Let Security Be On Your Side

In today’s evolving IT landscape, companies are constantly planning their next steps when it comes to business-critical...
09/21/2016Pablo Artuso

Onapsis Publishes Advisories for Cross Site Scripting and OS Command Injection Vulnerabilities

Today, the Onapsis Research Labs released 14 advisories for SAP and 6 for Oracle E-Business Suite. All of the SAP advisories...
09/08/2016

Clickjacking SAP Security Notes: Where to start?

Introduction A few months ago, we published a post about Clickjacking attacks, analyzing the nature of the attack, its related...
07/28/2016

Onapsis publishes 12 advisories for Oracle Business Critical Applications

Today we have released 12 new Oracle application advisories which affect two different products: Oracle E-Business...
07/21/2016

Onapsis Publishes 15 Advisories for SAP HANA and Building Components

Today, Onapsis Research Labs released 15 advisories related to SAP HANA and some building components, as well as Internal...
07/20/2016

Oracle Fixes a Record of 276 Vulnerabilities in July 2016

Yesterday, Oracle released its July 2016 Oracle Critical Patch Update (CPU). This post serves to provide Oracle...
04/25/2016

Oracle fixes 136 Software Vulnerabilities in April 2016

As a company, Onapsis is focused on securing business-critical applications such as SAP and Oracle. An important part of...
01/22/2016

Oracle Fixes 248 Software Vulnerabilities in January 2016

As a company, Onapsis is focused on securing business-critical applications such as SAP and Oracle. An important part of...

Reports

©2024 Onapsis | All rights reserved