CS Mar Apr 2022

Log4shell
for every organisation to ensure they are not
exposed to any potential threats from the
logging tool and make all the necessary
mitigations to ensure they do not become
targeted.
MASSIVE SHAKE-UP
"The LogJam (or Log4Shell) debacle shook the
world to its knees," says Niels Hofmans, head
of security at Intigriti. "Open-source software
is incorporated everywhere into the software
we use on a daily basis. However, we often
don't know what software 'materials', such as
Log4j, are built into the code libraries and
tools we operate-or even develop."
The good news is that a new standard,
called Software Bill of Materials (SBOMs), will
hopefully bring some resolution to this
problem, where a 'bill of materials' can be
(securely) delivered along with packaged
software releases, he adds. "This important
bill will improve our supply chain security
issues, at least by tenfold, since we will be
able to track our software in a uniformed
way. At the same time, software developers
will be able to understand contents more
clearly, identify all (transitive) dependencies,
and match everything to any security
vulnerabilities later on."
At the least, companies should consume
threat intelligence feeds (TI feeds) that
describe the latest attacks, trends and
patches so they stay on top of threats and
prioritize accordingly. "And when
cyberattacks do happen, a modern Web
Application Firewall can stop web attacks
from reaching your server; even better, if it
allows you to tweak its settings to catch the
latest attacks."
Configuration hardening is the practice of
disabling and tweaking aspects in a system to
improve its security, which could have
prevented this logging library from being
exploited, advises Hofmans. "And, even if it's
too late, endpoint detection & response
should stop or alert any exploitation attempts
and trigger you to go into red alert based
on any abnormal system behaviour. Finally,
to ensure an infected machine can only go
so far, network segregation [akin to the
Zero Trust Model] will limit its blast radius
to only authorised peers and not the whole
network."
As the head of security for Intigriti and
part-time bug bounty hunter; Hofmans
warns that this type of creative attack
certainly won't be the last. "However, there
are many accessible controls software users
can proactively implement now, rather
than waiting for the next attack to
happen."
SERIOUS FLAWS MOUNT UP
According to John Graham-Cumming, CTO
at Cloudflare, Log4Shell is the third serious
flaw that has affected a wide range of
Internet services: Heartbleed in 2012,
ShellShock in 2014 and now Log4Shell in
2021. "The Log4Shell vulnerability allows
an attacker to execute code on a remote
server, a so-called Remote Code Execution
(RCE). The vulnerability was particularly
serious, because of the widespread use of
Java and Log4j. Importantly, even non-
Internet facing software that uses Java
could have been exploitable as data gets
passed from system to system.
"When vulnerabilities like this are
disclosed, it's important for companies to
do two things: make sure their firewall is
configured to block the attacks - and talk
to their firewall vendor to see if they've
rolled out a specific blocking rule - and
patch the vulnerability as soon as possible."
Other best practices he recommends
include filtering and logging DNS queries
to block queries made to known malicious
destinations, securing network traffic
leaving your infrastructure with an
updated, and inspecting and filtering HTTP
traffic, which can block attacker attempts
to reach their destinations.
Niels Hofmans, Intigriti: the good news is
that a new standard, called Software Bill
of Materials (SBOMs), will hopefully bring
some resolution to this problem.
DANGER ON THE HORIZON
While Tim Mackey, principal security strategist
at the Synopsys CyRC (Cybersecurity Research
Center), recognises how Log4Shell would
have impacted businesses on many levels, he
emphasises most of all how any attack
targeting Horizon could represent a
disruptive threat to operations for those who
are running VMware Horizon as part of a
remote work programme. "As background,
many VMware products include Apache
log4j2 as their logging mechanism," he
states, "and, as the evolution of the log4j2
patches occurred, VMware was proactive in
their patch and mitigation efforts." Patch and
mitigation information has been available for
Horizon since December.
"From a risk management perspective,
focusing attention on VMware Horizon, or
any other individual product that uses log4j2,
misses the real business risk associated with
Log4Shell. If your patch management
process missed Log4Shell or you had to
manually scan each system to identify log4j2
www.computingsecurity.co.uk @CSMagAndAwards Mar/Apr 2022 computing security
33