Ask HN: How are you holding up with this Log4j madness? | Hacker News Reader

Ask HN: How are you holding up with this Log4j madness?

16 pointsfaizshah18 comments

Seems most of the industry has been rushing out deployments this weekend.

We have avoided Java internally, but I am mainly worried that our ecosystem of SaaS tools, service providers, even payment processors might be bleeding data breaches and nobody knows yet.

All it takes is one old ETL script on an unmaintained server that logs user-submitted records once a week, and their internal networks will be backdoored by script kiddies at some point soon, not to mention sophisticated actors. The companies that downsized technical teams during the pandemic simply don’t have the bandwidth to audit their entire security surface - #hugops to anyone being asked to do this. It’s a perfect storm. And we’re only seeing the beginning.

But it’s not like I’m going to use our corporate credentials to probe our own service providers to see which APIs are vulnerable - I have no desire to be banned and sued. And we’re too small an account to be able to do anything but make ourselves sound paranoid to our account managers. So I’m just waiting for the other shoe to drop. I hope it’s not something that splashes onto our reputation.

If I understood the vuln correctly, the injected malicious payload makes Log4J download and execute code from attacker's LDAP. I'm thinking that, in serious organizations, the call to the LDAP just won't make it through the firewall.

Even if we assume serious and dedicated security ops at these organizations, the attacker can specify the port to connect to. So any firewall would need to deeply inspect outbound traffic. And plenty of ETL jobs can mix in offsite data e.g. pulling from S3, or even from a hosted LDAP solution, so they wouldn’t prevent outbound traffic. The attacker could even use AWS IPs! As I said, a perfect storm.

I am relaxing at home, and if my employer wants they could pay me time and a half over the weekend, but I've received no call as of yet :) sounds like a monday thing?

At most places it's very much an ass-o-clock on whatever day it happens to be kind of thing. Maybe your place is less affected, or maybe they're just most clueless.

Hope your Monday goes well.

so far all is quiet on the eastern front, but we are definitely effected... the entire org (a very large one) deploys mostly java. I've lit beacons of Gondor, but knowing this org that might take a week to get anyone to take it seriously..maybe another month to start patching who knows.

Oof. Maybe whoever owns your systems via the exploit will patch it first. Seriously though, good luck, hopefully someone notices your beacons soon.

there are "assessments" happening, but I'd expect months or a year before this is all patched, so hopefully the infiltrators will patch the systems for us like u mentioned :)

our applications cannot make outbound connections from logging (they have to go through a specific class/function/service/factory that sets up all the metadata like mTLS, proxy, etc), and any non-mTLS attempts don't work, along with any to "not recognised" endpoints.

I noticed on thursday thanks to HN and mitigated before 2.15.0 released, and have done nothing all weekend.

i want to know who the fuck on earth actually has a use case of loading a class and running it inline from a logging call rather than calling getUserEmailFromLdap(ou, principal).toString() or something

IMO I don’t think the actual feature is bad.

I think the real problem is that some people consider logging messages data that must be sanitized (like SQL) while others don’t.

And when you mix these two groups of people, we have very major problems.

if at least anything "downloading executable code from elsewhere and running it" needs to be severely, excessively opt in behaviour.

the actual feature feels incredibly strange to me as someone that has written in a ton of languages and always explicitly treated it as a plain text string unless very explicitly intended to format it

It’s been nice knowing we are using a sane development stack that doesn’t include bloatware.

https://gist.github.com/seanmhanson/fe370c2d8bd2b3228680e388...

I’ve certainly been insane before and feel no offense by the parent comment. Simply linking this gist without an explanation of why you are or why you disagree seems like you cannot defend your opinion but with just a link to someone else’s opinion.

Again I feel no offense. You aren’t helping mental health (or anything for that matter) trying to censor language that is in no way malevolent in its usage.

As a person with a mental disorder I find the word “insane” in the context of software development to be perfectly cromulent.

I haven't heard many companies actually reporting major exploits, or any major sites having outages..

So I'm questioning whether this flaw really does result in remote code execution, or whether the vast majority of companies are using a version of log4j that doesn't have this flaw.

I run nothing on Java so doing "Kermit drinks tea" while looking at news. With a slight dread that what I am using might have similar problems that we don't know yet.

Reply on news.ycombinator.com