Details of the Inquiry
The Log4j vulnerability is said to affect a very large number of products. How can we tell whether it affects our systems? Is there also a way to tell whether we have already been attacked?
Only the important information is being shared on an urgent basis. Related vulnerabilities may continue to appear, so keep monitoring and use what is appropriate.
What is the remote-attack principle of this vulnerability? (A simple explanation)
– https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j
– https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
Which products are exposed to this vulnerability? (List of vulnerable products)
– You will be able to see that there really are a great many products that use log4j.
https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592
How can you tell whether you have already been attacked? (Python program for checking compromise)
– The embargo on a 0-day vulnerability is longer than one might think (the official CVE embargo is 90 days, and KISA defines it as 2 months, although an extension is possible depending on the case)
– With that in mind, and considering that this vulnerability became known to the vendor at least two months earlier, in early October, checking whether an attack has already occurred is more important than anything else
– It is a Python program that searches strings in log4j log files and looks for traces of an attack.
https://github.com/Neo23x0/log4shell-detector
How can you tell whether you are vulnerable? (Scanner for vulnerability checks)
– Scanners for Windows, Linux, and other operating systems (local scan): https://github.com/logpresso/CVE-2021-44228-Scanner
– Qualys scanner (local scan). The output is clean, with no unnecessary detail:
- Windows scanner: https://github.com/Qualys/log4jscanwin ⇐ There is no binary, and it must be compiled
- Linux scanner: https://github.com/Qualys/log4jscanlinux ⇐ It is a shell script, and the output is clean with no unnecessary detail
Response Guide in Q&A Form – KISA
Log4j Vulnerability Response Guide in Q&A Form (KISA)
Other References
– How to check and security-system countermeasures
https://www.picussecurity.com/resource/blog/simulating-and-preventing-cve-2021-44228-apache-log4j-rce-exploits
– Attack steps and, for each step, the WAF settings and Log4j configuration defense points
https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
– List of Apache Log4j vulnerabilities (CVEs) known to date
https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-37215/Apache-Log4j.html
Free Remote Scan with a log4j Scanner
– This is a remote scan from an outsider’s perspective, and the service is provided free of charge for 10 hosts or fewer
– Contact: info@wikisecurity.net, 02-322-4688