Apache Log4j Mitigation
- Update Log4j to version 2.15.x, 2.16.x or higher on systems using Apache, to mitigate exploits as soon as possible after appropriate testing.
- Upgrade (to 2.1.16, if you have direct access to Apache, and 2.1.15, if 2.1.16 is not available yet).
- Upgrade your vendor supplied or locally developed software as patches & updates become available.
- Where updates are not available, see if it is possible to remove the JndiLookup class from the classpath.
- Check (for every vendor that provides you with a web interface, including printers, and cloud services) to see if the log4j vulnerability is present in the vendor’s product, and if a patch or update is available.
- Log4j is a component of many commercial, Java-based software applications, Java applications and services with web displays, web-based control panels, and logging services. A List of software by vendor is at https://github.com/NCSC-NL/log4shell/tree/main/software
- A more extensive list of vendors is at: https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 A word of caution: some vendors, such as ServiceNow, put the information about their vulnerability or lack thereof behind customer portals to keep criminals from knowing if they are vulnerable or not.
- Monitor for unusually high CPU utilization as well as unexpected processes, system changes, services, network connections, and new users/groups. It is not known when the criminals discovered this exploit,
- Run full scans of an anti-malware application (SentinelOne, ClamAV, Bitdefender) on vulnerable systems before and after updates are reasonable precautions.
- Mitigate the vulnerability. If you are using Cloudflare Web Application Firewall, use the new controls to help mitigate any exploit attempts.
- Review web service, web application, web application firewall, and anti-malware logs for anomalies in the last 30 days on systems determined to be vulnerable
- Test software functionality, including backup or snapshot, and other systems that depend to ensure they still work.
- When systems and services are fully restored and operational, run an anti-malware check to see malware has been planted on the system prior to update.
- Notify the ISO of
- Systems, software, or services that are not vulnerable that you have checked
- Systems, software, or services that you have upgraded / and that were vulnerable
- Systems, software, or services which are vulnerable, but have no update/upgrade yet available. Also include any supplied information of when an update/upgrade is anticipated.
- The ISO has scanned campus. If you would like the ISO to perform a scan, please contact us.
- Expect communication from the RIT Information Security Office, as scanning and vulnerability detection capabilities improve, and risk is managed.
NOTE: If you have an exception on a system running Apache, services may become available.
The ISO recommends patching as soon as the patch becomes available, taking only the time to take a snapshot or backup prior to patching. And even with taking a snapshot or backup, if that can be done with Apache or the embedded components disabled, that is the preferred method.
All RIT system owners are expected to keep systems up to date with the latest patches and updates. In the standards, the language makes some allowance for professional judgement, maintenance windows, and other things that might delay implementation, but we expect you to use your professional judgement to weigh the risks of delaying implementation against the risks of exploitation, and the resulting impact to services of the cleanup efforts.
Log4j is a Java-based logging library maintained by the Apache Software Foundation. According to the Cloudflare Blog, “In the affected Log4j versions, Java Naming and Directory Interface (JNDI) features used in configuration, log messages, and parameters can be exploited by an attacker to perform remote code execution. Specifically, an attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.”
The use of this exploit was discovered through it being exploited on Minecraft. You will see references that the exploit is in the wild, but that doesn’t convey the gravity of the situation. It is not safe to assume that the gamers in Minecraft discovered it. A safer assumption is to look at all your systems that have updates as if they have already been compromised.
It is reported that one of the ways that criminals are monetizing the ability to run arbitrary code is through cryptocurrency mining, but distributing ransomware, infostealers, or botnets would also be valuable. Common applications that handle direct authentication (not brokered by Shibboleth or multifactor authentication methods), would also be targets for account stealing.
This may be the most damaging exploit the Internet has seen. It has affected all Apache (web server) installations, as well as software that embeds the log4j logging platform. Log4j is a flexible open source utility that because of its availability, capabilities and reliability. Cloud services as large as iCloud have been affected, and though now updated, this is a zero-day exploit with remote code execution capabilities. Translated, that means that the criminals discovered it before the developers and vendors did, and for some unknown amount of time, they could place and execute any software on systems that were affected. It is the commonality of the log4j utility that makes this so significant. It has been in use by Equifax, and 65% of fortune 100 companies on their web front ends. In addition to some cloud services and some commercial public websites, the utility may be present in some of the smallest single-purpose Internet of Things products. Raspberry Pi single-board computers, often used in signage and control applications, may also have Apache loaded on them.
- Apache Log4j Security Vulnerabilities (Apache.org – Updated 12/13/21)
- https://github.com/NCSC-NL/log4shell/tree/main/software (list of vendors and products)
- https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 (more extensive list of vendors)
- Security warning: New zero-day in the Log4j Java library is already being exploited, ZDNet, 12/10/21
- Zero-day in ubiquitous Log4j tool poses a grave threat to the Internet, Ars Technica, 12/10/21
- New zero-day exploit for Log4j Java library is an enterprise nightmare, Bleeping Computer, 12/10/21
- Inside the Log4j2 vulnerability (CVE-2021-44228) 12/10/21
- CVE-2021-44228 - Log4j RCE 0-day mitigation, Cloudflare Blog, 12/10/21
- Download Apache Log4j 2, Log4j, 12/6/21
- RCE in log4j, Log4Shell, or how things can get bad quickly, Internet Storm Center, 12/10/21