Fresh warnings have been issued by RSA Europe and ERPScan following the discovery of a modified banking Trojan that now also searches for SAP client applications on infected systems. Recently a new variant of the malware Trojan.ibank was found by researchers at Dr. WEB who then passed on the information to ERPScan, a company which develops security monitoring products for SAP systems.
RSA Europe also issued a warning about the new malware variant suggesting that its existence could mean that there is a new wave of SAP based attacks coming. The issue of the malware was discussed by Alexander Polyakov, co-founder and CTO of ERPScan, at the RSA Europe security conference in Amsterdam which hosted sessions on the dangers of SAP and ERP vulnerabilities.
According to Polyakov one of the likely ways that attackers could be using the new malware is to gather information that could then be sold on the black market. However an alternative scenario is that the attackers will wait until a larger number of systems are infected and then start to steal sensitive information via a specially crafted malicious SAP modules which the Trojan uploads from and command and control server.
“There are dozens of ways to steal those passwords and use them,” said Polyakov to Dark Reading. “It is possible to connect to SAP Server and do any kind of fraud in the system or simply steal critical information such as client lists or employees’ personal information. We decided to warn people and SAP’s Security response team with whom we closely work before this can happen.”
Once the malware has found a SAP client there are lots of ways to steal information including from configuration files that contain the IP addresses of the servers. There is also the possibility of sniffing for passwords. Once on to the servers the cyber-criminals can perform all many of malicious activities, including theft and fraud via false transactions.