Log4j 2.15.0 – Previously suggested mitigations may not be enough

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by mol4711 on Thursday December 16, 2021 @04:45AM (#29576627)

This JNDI "feature" is 8 years old. It was merged in 2013 from what I have seen, and has been defended by some as an "useful" feature. It has been known since at least BlackHat 2016 presentation that this is an incredibly dangerous and stupid thing to keep.

cricket noises nobody reacted until now when minecraft servers got hacked.

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by josefx on Thursday December 16, 2021 @06:23AM (#29577160)

> and has been defended by some as an "useful" feature.

I would say the feature is useful but the implementation is insane. I would expect a SQL prepared statement approach, only contents of the statement / format string are resolved. Interpreting variables in user provided input just asks for SQL injection attacks and needs to be either prohibited or extremely restricted.

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by abhishekjha on Thursday December 16, 2021 @06:24AM (#29577165)

I guess you are referring to this[0]. I am surprised if it was known that early then why did it take so long to find the issue? Or were exploits already run earlier and nobody reported?

[0]https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-...

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by joe_guy on Thursday December 16, 2021 @09:16PM (#29586918)

I only skimmed it but couldn't find any references to log4j.

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by js8 on Thursday December 16, 2021 @04:57AM (#29576690)

> nobody reacted until now when minecraft servers got hacked

That shows which part of the IT industry is really needed.. :-)

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by bombcar on Thursday December 16, 2021 @08:26AM (#29577861)

More importantly Minecraft servers are a target of convenience that both could and would be attacked by script kiddies.

The open question is did anyone exploit this quietly and targeted before?

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by jethro_tell on Thursday December 16, 2021 @11:53AM (#29580336)

Of coarse. Especially if it was known since black hat 2016.

[ Parent | on HN ]

Re:Log4j 2.15.0 – Previously suggested mitigations may not b... by selimnairb on Thursday December 16, 2021 @06:42AM (#29577240)

This whole fiasco is an argument to keep things simpler whenever possible.

[ Parent | on HN ]