topic Re: SAP userid password cracking tool? in Application Development and Automation Discussions

SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 00:49:43 GMT

hi - can anyone confirm if SAP has a tool/utility they can use to crack a password - we have a situation where it is much easier for us if we could have them help us determine what a password is for an ALE user than changing it and aligning the new pwd is the many different places it is used.

i assume SAP has a tool for this, but not sure if they are willing to help customers w/ it.

i can see the hash code in usr02.bcode field for my user in question and could provide them that info...

thanks

Re: SAP userid password cracking tool?

jurjen_heeck — Wed, 10 Sep 2008 06:12:37 GMT

> hi - can anyone confirm if SAP has a tool/utility they can use to crack a password - we have a situation where it is much easier for us if we could have them help us determine what a password is for an ALE user than changing it and aligning the new pwd is the many different places it is used.

To avoid problems like this one have a look at trusted rfc connections. That way there is no need to store passwords.

> i assume SAP has a tool for this, but not sure if they are willing to help customers w/ it.

I doubt it and I actually hope they do not have it. How would that help customers to become sox-compliant?

Besides that hashing passwords is generally a one-way trick.

> i can see the hash code in usr02.bcode field for my user in question and could provide them that info...

Hopefully they can't do a thing with that

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 06:43:49 GMT

The idea is to manage the connections by co-ordinating the passwords, both the one enetered in SU01 and the one entered in SM59.

This is much easier and more secure when you respect the cardinality of the connections, i.e. avoid MANY (sm59) to ONE (su01) connections.

Besides, in higher releases you cannot even see the SM59 hash in RFCDES anymore....

Such a publicly available tool would be predestined for misuse...

Cheers,

Julius

Re: SAP userid password cracking tool?

Bernhard_SAP — Wed, 10 Sep 2008 07:48:30 GMT

Hi Ben,


> i assume SAP has a tool for this, but not sure if they are willing to help customers w/ it.
>

Beleave me or not:

I can confirm, that we (SAP) do not have such a tool.

Do you think, that high sensitive customers still would buy the software, if SAP could crack their passwords with a tool?

Nevertheless: any password is crackable. It is only a quesiton of which time you are willing to spend on that crack (100 years, 200 years,....).

So do not calculate with that possibility of password decryption from SAP.

b.rgds,

Bernhard

Re: SAP userid password cracking tool?

jurjen_heeck — Wed, 10 Sep 2008 08:00:29 GMT


> I can confirm, that we (SAP) do not have such a tool.

Thanks for confirming! Sigh of relief here

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 10:07:51 GMT

Of course, SAP has such a tool. Not in a complete form, but the most important and hardest to write part is there. Just reflect what is necessary:

1. A dictionary. Freely available on the net.

2. The hash of the password to crack. Is in the database.

3. The seed (I assume that SAP uses a seed; previous versions didn't have a seed). Is most probably in the database as well.

4. The hashing algorithm. This is built in every SAP kernel because this is also needed to verify a password during logon and to set a password.

5. A small framework tying everything together. This is trivial and there are enough password crackers around that show somebody how to write such a framework.

Of course, trying out all password is a time consuming task that can be highly parallelized, however.

So, strictly spoken, SAP did not tie everything together. But a decent programmer at SAP has such a tool written inside a week.

Re: SAP userid password cracking tool?

Bernhard_SAP — Wed, 10 Sep 2008 11:25:19 GMT


> 4. The hashing algorithm. This is built in every SAP kernel because this is also needed to verify a password during logon and to set a password.

No, we can only encrypt, not decrypt with the hash algorithm used.

b.rgds, Bernhard

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 11:27:25 GMT

I think that you have misunderstood the question...

He does not want to brute force or dictionary attack the SU01 password.

He wants to reverse the SM59 password so that he can set it in the target SU01 without "disturbing" the SM59 settings of (possibly) other systems using the same ID.

All round bad idea...

Cheers,

Julius

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 12:26:37 GMT

No, we can only encrypt, not decrypt with the hash algorithm used.

Of course, otherwise it wouldn't be very useful. But there are ways around it; they are just time consuming. Please reconsider my post.

Of course, SM59 will need to store passwords with a reversible algorithm. Otherwise, it would not be able to furnish the password to the "other" server. This is just obfuscation and it should be possible to crack this (you only have to look for it long enough in the code).

Re: SAP userid password cracking tool?

Bernhard_SAP — Wed, 10 Sep 2008 13:23:45 GMT

Hie Sietze (I suppose that this is your first name - sorry if not),


> Of course, SM59 will need to store passwords with a reversible algorithm. Otherwise, it would not be able to furnish the password to the "other" server.

we compare only the hash values during log on. So using sm59 there is no decryption for passing the password to the remote system. I don't know, where you have found the decryption coding....

b.rgds, Bernhard

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 13:51:30 GMT

For an un-trusted RFC, the user is a background user (no dialog logon), so the password authentication seems to be taken care by the comparision of hash values (as suggested by Bernhard)..

For that matter, for a trusted RFC, where a dialog user becomes an RFC service user, it seems there isn't any password verification. Because the source system doesnot mantain any password in SM59 and the password in the destination can always be different from what the user is having in source system. At most the system would be checking if the user is locked/unlocked/validity period apart from the necessary auth objects S_RFC and S_RFCACL.

Correct me if I am wrong!

Thanks!!

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 15:06:56 GMT

thanks all for a lively (much more than i expected) discussion. julius was right in my intentions...i am not trying to unearth a tool to crack passwords myself. we just have a situation w/ many SM59's using an ALEREMOTE user - and no one knows what the current password is. so if we need to create a new Source System in RSA1 for our BW system (which uses this ALEREMOTE user by default for the ALE/sm59's between systems) we either need to

1) chg the ALEREMOTE password and update all the corresponding SM59's in all the different systems

2) somehow figure out what the current password is, so we "know" what it is and can then create a new Source system connection in RSA1 and feed it the ALEREMOTE password

sounds like there is no way for us to use the latter option sadly...

thanks

Re: SAP userid password cracking tool?

jurjen_heeck — Wed, 10 Sep 2008 15:50:18 GMT

> we either need to

> 1) chg the ALEREMOTE password and update all the corresponding SM59's in all the different systems

> 2) somehow figure out what the current password is, so we "know" what it is and can then create a new Source system connection in RSA1 and feed it the ALEREMOTE password

> sounds like there is no way for us to use the latter option sadly...

1) will be your best short-term option. Please do investigate the option of 'trusted rfc' to rid your system of ale passwords completely. The problem you're facing should be a good motivation.

Jurjen

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 15:56:38 GMT

BW would have been my second guess. That you are forced to have uncardinal RFC connections is in my opinion a design error in there somewhere...

My first guess had something to do with your email address which is visible in your SDN profile - you can use the option "Hide" to save it in a type of "Secure Store", which then only you can see in cleartext. (sorry for the pun

The Trusted RFC is a valid and popular solution, but you have to be very carefull in how you set it up.

Worste case everyone can logon as anybody else and per default you loose a layer of application security.... (except for DDIC and SAP*).

The thing about stuff like this (cracking passwords etc) is that anyone smart enough to find and work it out, is most likely smart enough to know that they should keep it to themselves...

Cheers,

Julius

Re: SAP userid password cracking tool?

jurjen_heeck — Wed, 10 Sep 2008 17:39:31 GMT

> The Trusted RFC is a valid and popular solution, but you have to be very carefull in how you set it up.

> Worste case everyone can logon as anybody else and per default you loose a layer of application security.... (except for DDIC and SAP*).

In detail: The RFC-user must have the object S_RFC_ACL with proper values in his profile on the trusting side. Luckily this is one of the objects never included in SAP_ALL.

So if you connect from system A to system B you need to have an account with identical naming on either side and must have this object in the profile on system B. Trusted RFC's can both be set up with fixed userid's and 'logon user' or 'current user' (no system in reach at the moment, don't know the exact wording). The actual rights of the rfc user on system B determine what can be done there.

The risk Julius mentiones is a bit like putting op a sticky note with the password beacuse you do not want to lose it again..... just giving everyone a 'starred-out' S_RFC_ACL on all systems and trust they do not know how to use an rfc connection.....

Jurjen

Re: SAP userid password cracking tool?

Former Member — Wed, 10 Sep 2008 19:10:24 GMT

> ... per default you loose a layer of application security...

> The actual rights of the rfc user on system B determine what can be done there.

That depends on how your system is configured...

There is a old thread here about that topic - the distinction between an "authentication check" and an "authorization check".

Search terms:

> In the real world, if I present my passport to somebody at an airport they are able to look at it and use it to determine my real identity, then they can decide whether I am allowed to enter the airport to board an airoplane.

=> "Somebody at the airport" should also determine which airoplane you board... (the entry points to the destinations).

Cheers,

Julius

Re: SAP userid password cracking tool?

Bernhard_SAP — Thu, 11 Sep 2008 05:39:38 GMT


> In detail: The RFC-user must have the object S_RFC_ACL with proper values in his profile on the trusting side. Luckily this is one of the objects never included in SAP_ALL.

Hi Jurjen,

just a little comment on this....

==>don't rely on that .....

Have a look at SAP note #410424 -->ADD_S_RFCACL.... I always set the switch to 'YES' to avoid problems for my sap_all users...

b.rgds, Bernhard

Re: SAP userid password cracking tool?

Former Member — Thu, 11 Sep 2008 05:48:14 GMT

> Have a look at SAP note #410424 -->ADD_S_RFCACL.... I always set the switch to 'YES' to avoid problems for my sap_all users...

Are your SAP_ALL "users" (a.k.a. SAP_ALL "complainers") aware than anyone on the trusted system can logon to the trusting system as them without needing nor changing the password?

Cheers,

Julius

Re: SAP userid password cracking tool?

jurjen_heeck — Thu, 11 Sep 2008 06:18:34 GMT


> I always set the switch to 'YES' to avoid problems for my sap_all users...

Okay, I forgot the words "by default"

I never change this switch but prefer to tell the SAP_ALL users they might run in to the occasional boundary and that it's also for their safety.

Doesn't really matter because it only changes their request from "give me SAP_ALL and SAP_NEW" to "make sure I can do everything". The following discussions are all too familiar......

Nice topic!

Re: SAP userid password cracking tool?

Former Member — Thu, 11 Sep 2008 08:16:53 GMT

Last night I started thinking about this discussion, and two questions striked me. I am putting them on this forum first thing in the office:)

(1) Which table contains the hash value of the password which is mentioned in sm59-untrusted RFC?

(2)Although manual update of SAP standard tables is a bad practice. What if somebody copies the hash value of password from usr02 of destination system and updates that table (containing sm59 password) in the source system?

I would love to know what have a I overlooked!!:)