Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Director on Log4j Vulnerability

cisa.gov

Post reply on HN
Print view View original

21–30 of 85 posts

Re: CISA Director on Log4j Vulnerability

#21

Post by eitland »

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it.

However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network?

Why is Deno the only one who seems to have a good solution for this, and why doesn't Deno have more traction?

I know one can do a lot more using outbound firewalls and selinux but after seeing how brilliantly Deno solves this I wonder why not every program lets me do this.

Re: CISA Director on Log4j Vulnerability

#22

Post by mhoad »

taspeotis wrote: post #6

I think CycloneDX [1] is the go-to SBOM specification these days. [1] https://cyclonedx.org/

I was just digging into Cloud Native Buildpacks (buildpacks.io) as an alternative to Dockerfiles yesterday and realised that they actually have SBOM generation built into them for popular languages which is a really nice easy security infrastructure upgrade for everyone using them.

Re: CISA Director on Log4j Vulnerability

#23

Post by charcircuit »

bushbaba wrote: post #15
lixtra wrote: post #13

Earlier quoted context omitted.

Do you have any java in your application stack (i.e. elastic search)? If there’s no java, then there’s no log4j and you may worry about other issues.

*are you using ElasticSearch, flink, spark, prest,…etc. do they read in user data supplied by your front end. Could this user data end up being logged intentionally or part of an error log output. If so, you might be vulnerable and should update those systems.

those don't run on the front end

Re: CISA Director on Log4j Vulnerability

#25

Post by beebeepka »

eitland wrote: post #21

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solu…

I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog.

Anyway, how does Deno solve this?

Re: CISA Director on Log4j Vulnerability

#26

Post by Xylakant »

charcircuit wrote: post #23
bushbaba wrote: post #15

Earlier quoted context omitted.

*are you using ElasticSearch, flink, spark, prest,…etc. do they read in user data supplied by your front end. Could this user data end up being logged intentionally or part of an error log output. If so, you might be vulnerable and should update those systems.

those don't run on the front end

It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sorry for my ex-colleagues that do.

Edit: I haven’t tested or checked whether ES is vulnerable or not - but given the severity of this issue I’d default to the pessimistic stance of assuming it is, until proven otherwise.

Re: CISA Director on Log4j Vulnerability

#27

Post by asjfj9 »

ygjb wrote: post #17
rlt wrote: post #7

“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this?

I work for a large non-US based tech company and have not heard anything about this beyond HN.

Re: CISA Director on Log4j Vulnerability

#29

Post by octodog »

asjfj9 wrote: post #27
ygjb wrote: post #17

Earlier quoted context omitted.

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.

I work for a bank in APAC region and we had at least one big change out on Friday evening to address this.

Re: CISA Director on Log4j Vulnerability

#30

Post by nix23 »

cscurmudgeon wrote: post #10
rlt wrote: post #7

“we are also convening a national call with critical infrastructure stakeholders on Monday afternoon” Shouldn’t this be happening, like, yesterday?

Its the weekend! Security can wait. /s

For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)
Post reply on HN