Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Director on Log4j Vulnerability

cisa.gov

Post reply on HN
Print view View original

31–40 of 85 posts

Re: CISA Director on Log4j Vulnerability

#31

Post by miohtama »

Thorrez wrote: post #16
tex0 wrote: post #14

Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.

If the WAF blocks any request containing "{", that would be fairly safe, right? Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.

Cloudflare did something along these lines:

https://blog.cloudflare.com/how-cloudflare-security-responde...

Re: CISA Director on Log4j Vulnerability

#32

Post by eitland »

beebeepka wrote: post #25
eitland wrote: post #21

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solu…

I would like to use Deno but I am not in a position of power even if I was, it's not always easy to switch, especially with a full backlog. Anyway, how does Deno solve this?

I'll start with the question:

Deno solves this by making you specify on the command line or in a config file what an application should have access to, for instance for a simple web application you can specify that it only has read acesss to one folder of static files, write access to the log folder and can only connect to the postgres server. It is also very simple, see:

https://deno.land/manual@v1.16.4/getting_started/permissions

As for the first part, I'm in the lucky position where nobody can just rewrite everything to todays flavor of js, but where we can decide in the team to test out new technology when we have a chance to, for example on a new small project. There's another guy on the team that is enthusiastic about it too and I guess he'll throw together a demo soon, then we'll discuss it.

Re: CISA Director on Log4j Vulnerability

#33

Post by JimmyRuska »

This is pretty awful. Seems easy to fuzz every input form and API param to see which websites are vulnerable just by seeing which sites get a response. Once a site is found to be vulnerable, a malicious actor can try to funnel all logs to an external server, add a remote shell, and potentially scan the production network of whatever was running log4j. Once in the internal network, they can again scan for log4j exploits. Too many groups blanket whitelist cloud IPs like AWS lambda. Seems like there will be a cascade of experian-level data leaks coming. Even if things are somewhat locked down we've seen time and time again, there's internal sprawl where access to an internal bucket or git repo, or an escalation in the CI/CD pipelines leads to full access, then data dumps/leaks.

Re: CISA Director on Log4j Vulnerability

#34

Post by xiphias2 »

asjfj9 wrote: post #27
ygjb wrote: post #17

Earlier quoted context omitted.

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.

I had an ex colleague at Google talking about it on Facebook...if he had to bring an internal stuff of Facebook, it must be really bad.

Re: CISA Director on Log4j Vulnerability

#35

Post by nl »

eitland wrote: post #21

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solu…

The JVM running with a security policy can do this.

It's pretty rarely done though.

Re: CISA Director on Log4j Vulnerability

#36

Post by bsagdiyev »

asjfj9 wrote: post #27
ygjb wrote: post #17

Earlier quoted context omitted.

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.

It’s definitely happening. People are just too busy to post about it. I’m on a few hours sleep over the last couple days myself.

Re: CISA Director on Log4j Vulnerability

#37

Post by olliej »

nix23 wrote: post #30
cscurmudgeon wrote: post #10

Earlier quoted context omitted.

Its the weekend! Security can wait. /s

For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)

I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?

Re: CISA Director on Log4j Vulnerability

#38

Post by MomoXenosaga »

asjfj9 wrote: post #27
ygjb wrote: post #17

Earlier quoted context omitted.

No. The stakeholders are busy patching their shit. Pulling folks into meetings shouldn't be the priority when teams around the world in virtually every tech organizations are in firefighting mode. This type of a call would likely be focused on assessing current state at that point.

Could you share links to any threads or accounts people are sharing regarding tech organisations in firefighting mode against this? I work for a large non-US based tech company and have not heard anything about this beyond HN.

It was on the news in my country. There have been several notable ransomware attacks in the last few years, it's become an issue for a country and government that's gone all in on digital.

Re: CISA Director on Log4j Vulnerability

#39

Post by wiredfool »

Xylakant wrote: post #26
charcircuit wrote: post #23

Earlier quoted context omitted.

those don't run on the front end

It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sor…

I'm seeing on 7.15, logstash and elasticsearch both ship log4j in the vulnerable range, but in my case, I'm running a new enough java that it shouldn't be an issue.

Re: CISA Director on Log4j Vulnerability

#40

Post by technion »

tex0 wrote: post #14

Someone should tell them that any system that it logging user supplied data can be affected. Not only "user facing" systems. Not even a WAF can protect these.

Sadly every WAF vendor is falling over themselves to claim otherwise. I've already had arguments with senior leadership suggesting there's no need to worry about patching because multiple vendors have promised their solutions are better.

The further I get into security the more embarrassed I am for some of the offerings.

Post reply on HN