Hacker News Reader

Comment by Scoundreller | Hacker News Reader

Another eli5 request: as a home user or a mobile phone user, do I have anything to worry about?

Is there some kind of query/search I can do on my own computer to see if any application has integrated log4j?

It's been widely reported that iCloud is exploitable (by setting your phone's name to something that includes the "${jndi:ldap://...}" incantation), so if you're using an iPhone, cloud services you use may have been compromised. Haven't seen an assessment yet of exactly what's at risk from that. Also haven't seen much about Android apps using log4j -- depending on how (and whether) Android's nonstandard library handles JNDI, this may be mitigated, but stay tuned.

As to home PCs -- if you're running anything written in Java which logs strings under somebody else's control (email subject lines, to cite one potentially plausible example), well... they might be able to run code on your box.

It's not clear if iCloud is exploitable. Just the DNS lookups do not prove that remote code execution via ldap is active. In fact, if they are using an up to date JRE, it's not. I tried to exploit my own apps and could only get it to work when setting com.sun.jndi.ldap.object.trustURLCodebase to true

I'm not a security expert. I spent a good chunk of time yesterday mitigating this with our security people so I have a decent overview of the bug and how it's exploited. If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you. Take this as inexpert guidance until someone more authoritative chimes in. The vector of vulnerability here is user content getting into log messages, as can happen if you log headers from user connections for example.

Actually, the surface of attack is larger. It is: the machine receives strings from a service that's been connected to the internet somehow and the machine itself server can connect to the internet. A non-obvious example would be logs/data that will be processed by Solr.

> If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you.

The direction of the connection isn't relevant. For instance, when you are playing Minecraft and connect to a server, the connection starts from inside your network, but could be used to attack your Minecraft client.

>others can connect to from outside your network

Doesn't exactly cover it. Strings, uh, find a way.

Reply on news.ycombinator.com