News for hackers. Stuff that matters.

A comment on Log4jscanner. Parent comment

Re:Log4jscanner by xorcist on Saturday January 01, 2022 @04:04PM (#29762761)
It wouldn't be safe against an someone who actively tries to hide code, but the classloader requires the class files to be appropriately named, so if unzip -l doesn't show any suspect class names that should be enough in practice.

A Linux VPS running a Node app is unlikely to even have Java installed. It's a pretty big dependency and you couldn't miss it.

[ Parent | on HN ]
Re:Log4jscanner by yosito on Saturday January 01, 2022 @04:21PM (#29762961)
It seems like it would be easy to miss if it's in a docker container. Would auditing my docker containers be a good idea?

Also, is there a good command to run to reliably check if Java is installed on a system?

[ Parent | on HN ]
Re:Log4jscanner by edoceo on Saturday January 01, 2022 @04:36PM (#29763090)
> Would auditing my docker containers be a good idea

Yes! I frequently review any containers from the cloud I run. Load on isolated VM, start, cursory inspection at least. Then with images I'm happy with we keep them internally, until we need the upgrade.

[ Parent | on HN ]
Re:Log4jscanner by psYchotic on Sunday January 02, 2022 @09:48AM (#29769110)
May I suggest you look into grype[0], or some other similar tool? It can be used to scan images for vulnerabilities. You'll probably find a bunch of vulnerabilities that aren't likely to actually affect you, but still, at least you'll know they're in the images you're running. And maybe you'll start using things like docker-slim[1] on your own images to get rid of those vulnerabilities you do find.

[0]: https://github.com/anchore/grype

[1]: https://github.com/docker-slim/docker-slim

[ Parent | on HN ]