ABAP systems Protection against password hash attacks, SAP security note 1237762

SAP security note 1237762, “ABAP systems: Protection against password hash attacks”, is a note. Below are the symptom, reason and prerequisites and SAP recommended solution.

Description

Symptom

AP ABAP systems are vulnerable to password hash attacks, where attackers calculate the hash value of a password externally and compare it with the hash stored in the SAP database. Unlike other attack types, these cannot be mitigated by simply limiting the number of failed login attempts.

Solution

Focus on securing the password hash values against unauthorized read access since the hash algorithms themselves cannot be fully protected from disclosure.

Key Recommendations

• Protect Direct Database Access: Prevent unauthorized direct access to database tables using firewalls. Relying on the ABAP system alone to control access is insufficient.
• Restrict ABAP Program Access: Limit development authorizations in production systems to prevent the creation of unauthorized ABAP programs that can access sensitive tables. Refer to Note 13202 for detailed guidance on assigning restrictive authorizations.
• Secure Generic Tools Access: Ensure that tools like the table browser (SE16, SE17, SE11) have proper authorization checks. The USR02 table is assigned to the table authorization group ‘SC’. Manage this using transaction SE54. More details can be found in Note 1133739.
• Control Transport Request Permissions: Restrict permissions for managing transport requests to prevent the export of table contents via transports. Use authorization object S_TRANSPRT to limit activities.

General Remarks

• Separate Passwords for Environments: Use distinct passwords for production, test, and development systems. Implement Single Sign-On (SSO) with hardware-based or biometric methods for enhanced security.
• Enforce Strong Password Policies: Adopt restrictive password rules to minimize the risk of dictionary attacks. Utilize SAP NetWeaver’s support for long passwords and differentiate between lowercase and uppercase characters by setting login/min_password_lowercase appropriately.
• Protect Password History: Secure access to tables like USRPWDHISTORY and USH02 to prevent attackers from inferring current passwords from past ones.
• Secure High-Privilege Users: Limit the use of users like SAP* and DDIC, which have extensive authorizations. Consider deleting or locking the DDIC password and locking the SAP* user with Note 2383.

Reason and prerequisites

A password hash attack becomes feasible if attackers gain read access to the ABAP password hash values stored in the USR02 table, and attackers use the same password hash algorithm as the system to compute hashes.