It was identified on 12/09/2021 that companies utilizing an Apache logging component “LOG4J” are susceptible to a malicious zero-day vulnerability. Any Apache server or application that uses the Log4j2 library with Apache Log4j2 versions greater than 2.0 and less than 2.14.1 is vulnerable.
The vulnerability allows an unauthorized actor to inject code into the Log4j library to achieve remote control of a system.
IDENTIFY INDICATORS OF COMPROMISE (IOC)
If you are running the Apache Log4j version that is greater than 2.0 and less than 2.14.1 you are vulnerable.
A text search of your Apache and/or application log files for “jndi” and combined with a protocol such as LDAP, or DNS (examples:”jndi:ldap” or “jndi:dns”) may indicate that an attack was successful.
If the system is behaving in a non-standard or unusual way. It has been reported that most of the attacks are introducing cryptominers.
Check the firewall logs to determine if there are communications initiated from suspect systems to the Internet that is unexpected.
For applications that it is not known if the Log4j component is used, search across your clients and servers running Linux, Mac and Windows, looking for files named log4j*.jar. If it exists, then most likely that system is running an application that uses that component.
There is a list of vulnerable applications listed. Check to see if an application you are utilizing is listed here.
CONTAINMENT (If vulnerable or IOCs are identified)
F
or Apache servers, upgrade to Apache Log4j 2 version 2.16.0.
For systems that cannot be immediately or easily patched, there is a direct mitigation for the vulnerability that can be applied by enabling the execution flag of log4j2.formatMsgNoLookups
For applications executed through the Java Virtual Machine (JVM), this would take the form of a JVM argument of: -Dlog4j2.formatMsgNoLookups=true
Put your system/application behind a web application firewall (WAF). A WAF will protect against this injection attack.
Implement firewall rules that prevent your server from calling out to the internet. If the server can’t make the TCP connection in the first place, it can’t download anything either.
You may need to contact you application vendor for a patch or containment instructions.
REMEDIATION (If IOCs are identified)
If IOCs are present, the system will need to be inspected along with firewall logs to determine the activity and communications that are present.
A system inspection may identify additional programs or files that were introduced during the attack such as cryptominers.
Execute a full malware scan.
Consider a system rebuild. It is recommended a system image is maintained prior to rebuild if an investigation is warranted a later date.
If you would like to speak with HALOCK concerning this zero-day vulnerability, need assistance with analysis, or would like to further protect you web applications, please reach out to your HALOCK account manager at HALOCK to schedule a call with one of our security experts.
HALOCK Breach Bulletins Recent data breaches to understand common threats and attacks that may impact you – featuring description, indicators of compromise (IoC), containment, and prevention.
