DOOOOOOOOOOOM: Log4J

[xoggoth]

Surely this should be a DOOOOOOOOOOOM thread

It was! I doomed it!

https://forums.contractoruk.com/gene...hread-yet.html

[jamesbrown]

Not quite - this is more, if we log things we can find out where things go wrong in the wild - and there is this library that does it for us.

The problem is that it often isn't the core program that is asking for the library it's some third or fourth party subroutine that is using the logging code.

I think you misunderstood my point. Have you seen log4j recently? It provides look-ups and bindings for all sorts of crap, like docker container names, liquibase bindings etc. etc. etc.

[eek]

I blame all the weird crap that gets bolted onto otherwise simple implementations for "enterprise" reasons. "Oh, wouldn't it be cool if it could do this? Can we give you some money for it?" No, it wouldn't, no, don't bother.

Not quite - this is more, if we log things we can find out where things go wrong in the wild - and there is this library that does it for us.

The problem is that it often isn't the core program that is asking for the library it's some third or fourth party subroutine that is using the logging code.

[hobnob]

Build of materials? Is that right? I thought it was Bill of Materials.

Based on a Google search, both terms are in use. "Bill" probably makes more sense (to match a "Bill of Materials" for non-software), but I think that "Build" is either a common typo or based on the process of building software from various components.

[NotAllThere]

Build of materials? Is that right? I thought it was Bill of Materials.

[hobnob]

In terms of inventory, I'll repeat my comment from another thread:
"Some people have argued that this demonstrates the need for SBOM (Software Build Of Materials). The idea is that each application would include a list of all the modules etc. that it uses, then you can search through the list in a situation like this rather than having to hunt around all the vendors websites. However, there's still an argument for testing each device/website to check whether it's affected."
What no atW/SE DOOM thread yet? - Contractor UK Bulletin Board

Also, a tip for anyone using Tenable software to scan for this: they've added a template, but it requires SSH/Windows authentication to work properly (even though the attack will work without authentication). My first scan (without authentication) said that everything was fine, even when I knew that certain software (e.g. vCenter) was vulnerable.

[jamesbrown]

I blame all the weird crap that gets bolted onto otherwise simple implementations for "enterprise" reasons. "Oh, wouldn't it be cool if it could do this? Can we give you some money for it?" No, it wouldn't, no, don't bother.

[Lance]

too many companies finding out that they don't have a scooby doo what they're using and where it is.

It's not like log4j is part of an installed package, so most software inventories aren't aware of where it is.
And even updated and patched applications might not have updated and patched log4j

It's a bloody mess and I blame the programmers....

[BigDataPro]

Surely this should be a DOOOOOOOOOOOM thread

It is now!

[ladymuck]

Surely this should be a DOOOOOOOOOOOM thread

[BigDataPro]

Businesses all over the world are scrambling to fix the recent Log4J vulnerability. Client has postponed a Prod deployment that was supposed to happen today.

https://thehackernews.com/2021/12/ex...erability.html

Log4j: Serious software bug has put the entire internet at risk | New Scientist

Attacks exploiting the bug, known as Log4Shell attacks, have been happening since 9 December