Continued Action to Mitigate Log4j Vulnerability Required; Protect Building Automation System Security Keys to Prevent Denial of Access Attacks; Use Slow Holiday Period to Extend Change Windows and Patch Critical Windows Servers

As of this week, if you run Java 8, log4j 2.17.0 is the latest version fixing all known issues. For Java 7, log4j 2.12.2 should be used. As mentioned before: Keep good notes. You will have to do this again in the near future. log4j 2.15 fixes most issues, and the vulnerabilities in 2.15/16 are only exploitable if the logging configuration uses a non-default pattern layout with a context lookup. If there are critical systems still running log4j < 2.15: Patch them first before you redo the systems already at 2.15.

Johannes Ullrich

This is an infinite recursion bug. Essentially the function keeps being called until the host runs out of resources. I’m having flashbacks to recursive programming in college, and these are a bugger. You can either deploy Log4j 2.17, or you can change your code. The choices are to replace context lookups with thread context map patterns or remove context lookups where they originate from sources external to the application. Hint: deploy Log4j 2.17.

Lee Neely

As more focus is given to log4j, we expect other vulnerabilities to surface. Now that you have an inventory and understanding of your attack surface as it relates to log4j, apply the patches in a cadence that matches your threat model and risk appetite.

Jorge Orchilles

Healthcare remains a primary target, as is any sector perceived as over loaded and under-resourced. Spin up a team to review your security posture, include outsiders to avoid overlooking issues you’re desensitized to. Verify your monitoring is covering current and legacy systems. Make sure that your segmentation not only protects components from the primary network, but also protects the network from them.

Lee Neely

Do you have resources identified to help recover from an attack like this when it happens, or do you still have an action item for someone to find a resource after the last tabletop? If you have a resource, have you had them participate in your recovery exercise to make sure the vision and reality align? Lastly, find out if they have assessment and/or best practices options you can leverage to raise the security bar.

Lee Neely

Interesting case of not only a well-documented attack against building automation systems, but also a security feature used to achieve a DoS attack.

Johannes Ullrich

For many organizations, the last week of December brings reduced user and customer traffic and a good chance for longer change windows. If you have that opportunity, good idea to take advantage make sure all those Windows servers have all those critical Window patches that have come out in the last few months. If there is resistance, following Microsoft threat hunting guidance first may prove to be a good way to gain backing for doing so.

John Pescatore

The bulletin includes the specific events related to exploiting those vulnerabilities. Use the information to verify you’re in good shape. Also, after you apply the fixes to your domain controllers, have a serious conversation about making sure that is all those systems do, that you’re using application allow/deny lists to prevent execution of any “extra” software. Make sure that your Domain Admin accounts require MFA, particularly your Enterprise Admin.

Lee Neely

These vulnerabilities may have flown under the radar with all the focus on log4j. A compromised Active Directory can lead to the entire organization being compromised. Highly recommend applying these fixes and hunting for indicators of adversary behaviors.

Jorge Orchilles

We have not seen a lot of reports of actual breaches caused by log4j. A lot of exploit attempts, but most of them just spray the exploit without much consideration if the exploit will actually work. This smoke screen of exploit attempts may cover up some of the more dangerous attempts.

Johannes Ullrich

Risks like this can be reduced with a properly configured WAF and appropriate monitoring to detect maleficence. Look at this as a long-term strategy, not just appropriate for Log4j. While disabling Log4j is an option, the operational impact risk is high, suggest not choosing this approach.

Lee Neely

The fix is to upgrade to the fixed versions now. The FBI/IC3 bulletin includes indicators and actions to take to ensure you’re not compromised as well as Yara rules to aid detection. As this is being actively exploited, don’t wait to find out the hard way that you’re compromised.

Lee Neely

Keep an eye on lifecycle, particularly on SOHO focused products. If updates are no longer available, prioritize replacing the device. As Internet accessible NAS remains a target, don’t expose it, in any fashion, to the Internet. If you want external access to your content, consider using a mainstream cloud service (Google, Microsoft, Box, etc.) which are engineered and secured for this type of access. The cost difference will be far less than an incident.

Lee Neely

Make sure that you have published security contacts for reporting of discoveries such as this. Additionally, respond to and validate the reports, acting where needed. The last thing you want is public disclosure of weaknesses. Security through obscurity is still not a viable approach. In general US Agencies are bound by BOD 20-01 to develop and publish a vulnerability disclosure policy.

Lee Neely

A nice roundup to remind people that those behind most cyberattacks are not the Hollywood depicted “computer nerd,” but in fact are cold hearted criminals who do not care what damage they cause or who they hurt in order to reach their goals. During a pandemic it is unthinkable and despicable for criminals to be targeting healthcare providers.

Brian Honan

This is a good roundup of incidents and responses to learn from. Even if you’re not in healthcare, read to see where you may have similar gaps in your protections as well as better understand how the attacks are initiated and spread. Ask your team what would happen at your company and how they would handle it.

Lee Neely

At a minimum, clinical applications should be isolated from vulnerable applications like e-mail and browsing.

William Hugh Murray