Skip to main content

What is Log4j Vulnerability.

The Log4j vulnerability allows malicious attackers to execute code remotely on any targeted computer.

What is Log4j : Log4j an open source software, a logging library for Java, is widely used by businesses and web portals. Earlier this month, this open source software was in the news for its vulnerabilities.Log4Shell, an internet vulnerability that affects millions of computers, involves an obscure but nearly ubiquitous piece of software, Log4j. The software is used to record all manner of activities that go on under the hood in a wide range of computer systems.

How the vulnerability can affect computers: This vulnerability is a challenge that will be faced by many companies and organisations that run software applications and websites, because Java is so widespread.

Log4j records events – errors and routine system operations – and communicates diagnostic messages about them to system administrators and users. It’s open-source software provided by the Apache Software Foundation.

A common example of Log4j at work is when you type in or click on a bad web link and get a 404 error message. The web server running the domain of the web link you tried to get to tells you that there’s no such webpage. It also records that event in a log for the server’s system administrators using Log4j.

How does Log4Shell work?

Log4Shell works by abusing a feature in Log4j that allows users to specify custom code for formatting a log message. This feature allows Log4j to, for example, log not only the username associated with each attempt to log in to the server but also the person’s real name, if a separate server holds a directory linking user names and real names. To do so, the Log4j server has to communicate with the server holding the real names.

Unfortunately, this kind of code can be used for more than just formatting log messages. Log4j allows third-party servers to submit software code that can perform all kinds of actions on the targeted computer. This opens the door for nefarious activities such as stealing sensitive information, taking control of the targeted system and slipping malicious content to other users communicating with the affected server.

Companies coming up with solutions: Crowdstrike, an American cybersecurity technology company, has launched a free targeted Log4j search tool that performs a targeted search by scanning a given set of directories, and then runs a deeper scan on those file types matching against a known set of checksums for Log4j libraries, it said in a blog.

Global cybersecurity company Kaspersky details in its blog the measures to be taken to safeguard against this vulnerability. One should follow the Apache guidelines in their website and install the most recent version of the library (i.e.2.15.0). Businesses should use a security solution that provides exploit prevention, vulnerability and patch management components. In addition, the company also recommended installing security solutions on the servers, this will allow one to detect the launch of malicious code and stop the attack’s development.

The damage that can be done :

Hackers are scanning through the internet to find vulnerable servers and setting up machines that can deliver malicious payloads. To carry out an attack, they query services (for example, web servers) and try to trigger a log message (for example, a 404 error). The query includes maliciously crafted text, which Log4j processes as instructions.

These instructions can create a reverse shell, which allows the attacking server to remotely control the targeted server, or they can make the target server part of a botnet. Botnets use multiple hijacked computers to carry out coordinated actions on behalf of the hackers.

A large number of hackers are already trying to abuse Log4Shell. These range from ransomware gangs locking down minecraft servers to hacker groups trying to mine bitcoin and hackers associated with China and North Korea trying to gain access to sensitive information from their geopolitical rivals. The Belgian ministry of defense reported that its computers were being attacked using Log4Shell.

Although the vulnerability first came to widespread attention on Dec. 10, 2021, people are still identifying new ways to cause harm through this mechanism.

Stopping the Vulnerability :

It is hard to know whether Log4j is being used in any given software system because it is often bundled as part of other software. This requires system administrators to inventory their software to identify its presence. If some people don’t even know they have a problem, it’s that much harder to eradicate the vulnerability.

Another consequence of Log4j’s diverse uses is there is no one-size-fits-all solution to patching it. Depending on how Log4j was incorporated in a given system, the fix will require different approaches. It could require a wholesale system update, as done for some Cisco routers, or updating to a new version of software, as done in Minecraft, or removing the vulnerable code manually for those who can’t update the software.

Is Loj4j still vulnerable?

More than 40 - 50% of the user's continue to download the vulnerable version of the Apache Log4j, despite the efforts to upgrade the software - according to the Sonatype, which own's the Maven Central repository, which is considered to be the most significant repository of Java.
Labels:
Location: Mumbai, Maharashtra 400051, India

Comments

Post a Comment

Popular posts from this blog

Difference Between a Penetration Test and Vulnerability Assessment - Part 2

  The Difference Between a Penetration Test and Vulnerability Assessment - Part 2 What is the Difference Between a Penetration Test and Vulnerability Assessment? Part 2 of 2 Comparing Penetration Tests and Vulnerability Assessments In part 1 of this post, we focused on the Vulnerability Scans, Vulnerability Assessments, and  Vulnerability Management  in order to differentiate the 3 prior to digging into Penetration Tests. Now, let’s introduce and define Penetration Tests, explain the test itself and goals, then go through the different types of Penetration Tests. What is a Penetration Test? A  Penetration test , or pen test, is the process an ethical hacker conducts on a target and the IT environment to uncover vulnerabilities by exploiting them. The goal is to gain unauthorized access through exploitation which can be used to emulate the intent of a malicious hacker. Penetration test reports may also assess potential impacts on the organization and suggest countermeasures to reduce ri
Post a Comment
Read more

Top 10 In-Demand programming languages to learn in 2022.

This blog will focus on some of the most in-demand programming languages which will be dominant this year, 2022. For almost every subject's like Web Development, Artificial Intelligence, Machine Learning, Data Science, or any other, the most important prerequisite is the ability to program in programming languages. Before choosing a programming language, beginners should carefully consider many factors, including popularity, demand, career opportunities, and applications. JavaScript JavaScript is one the most well-known programming languages, with strong demand and a strong following. JavaScript is used by many well-known IT companies such as Uber, Google, Microsoft, Uber, and Microsoft. Although the language is best known for its ability to add responsive elements to web pages, there are many other uses. The language can be used for both front-end as well as back-end development. Developers find it attractive because of its interoperability with well-known frameworks like Vu
Post a Comment
Read more

Difference Between a Penetration Test and Vulnerability Assessment - Part 1

  The Difference Between a Penetration Test and Vulnerability Assessment - Part 1 What is the Difference Between a Penetration Test and Vulnerability Assessment? Part 1 of 2 Comparing Penetration Tests and Vulnerability Assessments The staff here at SecureOps is consistently asked the purpose and the differences between vulnerability scans, vulnerability assessments and penetration tests – including all the variations of both such as red teaming, capture the flag exercises, bug bounty programs and more. Our goal in this blog post is to work from a high level and explain the general differences between identifying vulnerabilities to a more detailed level and ultimately walk through what the services are from an execution perspective and what benefits they offer an organization in terms of improving security. Let’s start with answering the broad question first and dig deeper from the explanation that we use here at SecureOps. Vulnerability scans search systems for known vulnerabilities u
Post a Comment
Read more