Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Director on Log4j Vulnerability

cisa.gov

Post reply on HN
Print view View original

51–60 of 85 posts

Re: CISA Director on Log4j Vulnerability

#51

Post by lkschubert8 »

olliej wrote: post #37
nix23 wrote: post #30

Earlier quoted context omitted.

For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)

I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?

I've heard of similar things being done for ADA compliance. Something about requiring a phone line to be up at all the same times as the website so instead of a 24/7 call center you just turn the site off.

Re: CISA Director on Log4j Vulnerability

#52

Post by detaro »

olliej wrote: post #37
nix23 wrote: post #30

Earlier quoted context omitted.

For some company's that's true, in one i worked we shutdown all systems (including router and firewall) every Friday at 18:00 ;)

I recall some US gov agency, possibly the IRS of all things, that would only accept forms being submitted during US working hours. Because the computers also need time off I guess?

In some cases I know (with smaller orgs) it happens because someone put a requirement in that they need to react to incidents with the service within X hours, but didn't provide the budget for the employees or external service needed to have that 24/7.

Re: CISA Director on Log4j Vulnerability

#55

Post by tgv »

JimmyRuska wrote: post #33

This is pretty awful. Seems easy to fuzz every input form and API param to see which websites are vulnerable just by seeing which sites get a response. Once a site is found to be vulnerable, a malicious actor can try to funnel all logs to an external server, add a remote shell, and potentially scan the production network of whatever was running log4j. Once in the internal network, they can again scan for log4j exploi…

What do you think is happening? I’ve already found a few requests for / with a referrer that starts with ${jdni:

Re: CISA Director on Log4j Vulnerability

#56

Post by lolive »

The french announcement mentions this: "In general, it seems that the use of a Java runtime environment in version 8u121 or later makes it possible to guard against the main attack vector mentioned by the researchers behind the discovery."

Is it correct?

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/

Re: CISA Director on Log4j Vulnerability

#57

Post by cesarb »

wiredfool wrote: post #39
Xylakant wrote: post #26

Earlier quoted context omitted.

It doesn’t matter. An nginx web server logging an odd user agent, elasticsearch picks it up. And then, due to some error triggered by the attacker, the content of the webserver log line gets logged on the ES side (for example if it violates a constraint). Frontend bypassed, attack owns ES. I’ve spent my weekend celebrating that I don’t have Java software in a stack that I’m responsible for right now - and feeling sor…

I'm seeing on 7.15, logstash and elasticsearch both ship log4j in the vulnerable range, but in my case, I'm running a new enough java that it shouldn't be an issue.

As has been commented several times on other threads here on HN, a new enough Java only protects against one kind of exploit (directly loading arbitrary bytecode) but not others (serialization tricks to execute arbitrary function calls, or data exfiltration).

Re: CISA Director on Log4j Vulnerability

#58

Post by cesarb »

lolive wrote: post #56

The french announcement mentions this: "In general, it seems that the use of a Java runtime environment in version 8u121 or later makes it possible to guard against the main attack vector mentioned by the researchers behind the discovery." Is it correct? https://www.cert.ssi.gouv.fr/alerte/CERTFR-2021-ALE-022/

As has been commented several times on other threads here on HN, a new enough Java only protects against one kind of exploit (directly loading arbitrary bytecode) but not others (serialization tricks to execute arbitrary function calls, or data exfiltration).

Re: CISA Director on Log4j Vulnerability

#59

Post by _old_dude_ »

nl wrote: post #35
eitland wrote: post #21

There's a lot of talk now about a number of things including web application firewalls and how we must fund open source and I hope something good comes out of it. However, the thing that I wonder is why we still are in a position where every single application and every single dependency can attempt to load dlls (ref npm hacks lately) or reach out to the network? Why is Deno the only one who seems to have a good solu…

The JVM running with a security policy can do this. It's pretty rarely done though.

The idea of having different declarative security realms is fine but it's not what the Java Security Manager is.

The Java Security Manager is an API that allows to intercept and run codes, so devs use it as a Trojan Horse to patch code instead of fixing the root of the issue.

The Java Security Manager should die.

Re: CISA Director on Log4j Vulnerability

#60

Post by g_p »

SCHiM wrote: post #48
naltun wrote: post #45

Earlier quoted context omitted.

I work as a software engineer in cybersecurity. > embarrassed... for some of the offerings Welcome to the club.

I am half convinced you can build a successful cyber security business putting a box in a network that does absolutely nothing. I think there's a requirement to at least show a blinking led and have a, not necessarily patched, cable plugged in. But that's about it. My thinking is, that if you show a cool enough interface (not connected to the box), with lots of widgets and stats, and they don't detect a hack in the t…

You pretty much can:

> Case in point: the Air Gap. Levy set up a website showcasing a magic amulet of his own creation. Like many cyber defences, his piece of hardware promised to defend against all known and unknown viruses, and stop zero day exploits. His product? An empty box with a blue blinking light on it. Levy had to take his website offline when he started getting sales enquiries by email.

https://www.wired.co.uk/article/ian-levy-national-centre-cyb...

Post reply on HN