Research articles and posts on Martin Gallo

The Rise of Consent and Other Application-based Phishing Attacks

Tue, 10 Aug 2021 00:00:00 +0000

Introduction

Cloud-based applications are spreading across the entire Internet ecosystem. Developers can easily build applications that integrate with users and organizations by accessing their data directly from cloud platforms. The digital transformation has even accelerated this process, which in most cases relies on these processes to enhance and tailor as much as possible the user journey.

Knowing this scenario, malicious actors started to leverage the fact that users are bombarded with dozens of applications that connect to their accounts and identities and entice them into providing access to their valuable data. While most phishing attacks focus on the users themselves, application-based attacks use a cloud-enabled application as their main vector to access the victim’s information.

Protecting Credentials in SAP HANA: The Client Secure User Store

Thu, 29 Apr 2021 00:00:00 +0000

Introduction

One of the (many) challenges of managing large distributed systems is how to secure usage of credentials and cryptographic material. If you are doing things right, you are authenticating and securing all network paths and communications between systems, which requires the use of credentials, keys, tokens, certificates, and other forms of secrets. Protecting all those secrets is not an easy task, especially if applications and systems need to use them unattended and without an administrator’s intervention.

Exploring the SAP HANA SQL Command Network Protocol – Federated Authentication

Wed, 21 Oct 2020 00:00:00 +0000

Introduction

As detailed in the previous articles, the HANA SQL Command Network Protocol supports a variety of authentication mechanisms. In the early posts, we listed the supported authentication methods, and reviewed with some detail the password-based ones. This time, we are going to focus on the mechanisms available to federate the authentication process, and integrate SAP HANA with external identity providers through the use of different federation and Single Sign-On (SSO) technologies.

Exploring the SAP HANA SQL Command Network Protocol – Password-based Authentication and TLS

Mon, 10 Aug 2020 00:00:00 +0000

Introduction

In this article about SAP security topics, we continue exploring the HANA SQL Command Network Protocol, now looking into password-based authentication mechanisms and how to protect traffic with the use of TLS. The following is the second installment in our three-part series covering SAP HANA SQL Command Network Protocol. It is recommended you read the first installment in the series if you missed it: Exploring the SAP HANA SQL Command Network Protocol – Protocol Basics and Authentication.

Exploring the SAP HANA SQL Command Network Protocol – Protocol Basics and Authentication

Mon, 20 Jul 2020 00:00:00 +0000

Introduction

HANA Database is an in-memory database developed and sold by SAP. It has become the enterprise software company’s flagship product, by sitting at the core of SAP’s data management and advanced analytics offering. HANA serves also as the foundation of the technological platform on which its ERP, CRM and SRM run, by having it not only act as the database layer but additionally as an application server. Web-based business applications can be developed and run on top of the HANA platform. In this blogpost I’ll share a little bit about the basics of the network protocol that the HANA database (some time ago also called HDB from “Hybrid Data Base”) uses to communicate with clients, and discuss some particular scenarios concerning password-based authentication. Throughout the rest of the article we will refer to HANA and HDB as on-premise HANA Platform instances. Most of the content applies to HANA Cloud Platform and the SAP HANA Service in AWS, GCP and other cloud providers as well, but there might be small differences.

Why Browser Fingerprinting is Creating Challenges for Identity Security

Tue, 12 May 2020 00:00:00 +0000

Introduction

Uniquely identifying the user’s device or browser when accessing an online resource can be useful in very different contexts, and the impact can be different according to those contexts. With respect to identity security, the intelligence can significantly contribute to adaptive authentication journeys and the evaluation of risks when allowing access to resources. In this article we introduce the concept of browser fingerprinting and explore some of the challenges the industry is facing when it comes to utilizing this tool in a secure and privacy-preserving fashion.

Revisiting the Old and Looking at New Potential SAP Vulnerabilities

Tue, 07 Apr 2020 00:00:00 +0000

Introduction

Targeted attacks against system administrators are known to be practices some bad actors use when attempting to gain access to and compromise high-value environments. As system administrators use of a wide range of tools to manage the environments under their reach, an interesting entry point for such targeted attacks is through those tools and the way they are used. In this blogpost I’ll share a couple of stories of my past journey researching and understanding SAP’s archive file format, the tools available to operate them, and some of the findings that were derived from that learning process.

Hijacking 2FA – A look at Mobile Malware Through an Identity Lens

Wed, 25 Mar 2020 00:00:00 +0000

Introduction

In the last weeks, several news outlets reported on a new Android malware variant, that added capabilities to steal second-factor authentication codes using innovative ways. The original report from Threat Fabric includes interesting details about the overall malware behavior. In this post we’re going to focus on these new capabilities, review them from an identity perspective, and discuss what does it mean for identity security in general and for authentication strategies in particular.