The IT Nerd

One assumption about the 10 out of 10, extremely severe, you must fix right now Log4j security vulnerability was that it was limited to exposed vulnerable servers.

That may now be an incorrect assumption.

The security company Blumira claims to have found a new Log4j attack vector:

Previously, we understood that the impact of Log4j was limited to vulnerable servers. This newly-discovered attack vector means that anyone with a vulnerable Log4j version on their machine or local private network can browse a website and potentially trigger the vulnerability. At this point, there is no proof of active exploitation.

This vector significantly expands the attack surface and can impact services even running as localhost which were not exposed to any network. 

The client itself generally has no direct control over these WebSocket connections, which can silently initiate when a webpage loads. WebSocket connections within the host can be difficult to gain deep visibility into, which increases the complexity of detection for this attack.

Blumira suggests users “update all local development efforts, internal applications, and internet-facing environments to Log4j 2.16 as soon as possible, before threat actors can weaponize this exploit further”. This news makes this vulnerability which was already one of the worst ever seen, absolutely devastating.

Happy holidays sysadmins.

The NSO Group who makes the Pegasus spyware that targets iPhones is getting all the attention these days. And rightly so. It’s highly dangerous and should be made extinct as quickly as possible. But there’s a second piece of weapons grade spyware that’s out there that you need to worry about. University of Toronto’s Citizen Lab has released a lengthy report on ‘Predator’ after finding it on an iPhones running iOS 14.6 that had also been infected with NSO Group’s Pegasus.

Here’s what you need to know:

• Predator is made by a group called Cytrox based in North Macedonia.
• Predator and Pegasus have similar feature sets.
• Predator is delivered to the target’s iPhone via a malicious link sent over something like WhatsApp. When the target opens the link, Predator is able to gain access to the phone’s cameras and microphone, as well as pull data off the phone.
• Unlike Pegasus, Predator cannot silently infect a phone without user interaction. In other words, the spyware relies on user input, like clicking a malicious link, to activate.
• Predator can survive reboots. Pegasus can’t.
• Predator was likely being used by government customers in Armenia, Greece, Serbia, Indonesia, Madagascar, Oman, Egypt and Saudia Arabia. Meta has also crossed paths with Cytrox and their investigation also found Predator customers in Vietnam, the Philippines and Germany. It should also be noted that Meta has banned Cytrox from its platforms and said it removed over 1,500 Facebook and Instagram accounts associated with numerous groups including Cytrox.

Citizen Lab has served this info up to Apple, and the company is apparently investigating. And it isn’t clear if this has already been patched or not. So until we get clarity on that, the usual advice applies. Which is don’t ever click on links that are sent to you.

Because of the rather catastrophic Log4j vulnerability that sent the planet scrambling to patch all the things last week before they were exploited by bad actors. Which is something that didn’t take long to happen. It’s now become a free for all as bad actors are really going to town in terms of exploiting this vulnerability. For example, Conti ransomware uses Log4j bug to hack VMware vCenter servers: 

Conti, one of the largest and most prolific ransomware gangs today with tens of active full-time members, appears to have taken interest in Log4Shell early on, seeing it as a possible attack avenue on Sunday, December 12.

The gang started looking for new victims the next day their goal being lateral movement to VMware vCenter networks, cybercrime and adversarial disruption company Advanced Intelligence (AdvIntel) shared with BleepingComputer.

Dozens of vendors have been affected by Log4Shell and rushed to patch their products or provide workarounds and mitigations for customers. VMware is one of them, listing 40 vulnerable products.

While the company provided mitigations or fixes, a patch for vCenter versions impacted has yet to become available.

You have to give Conti credit for acting so quickly. But that also means that a whole lot of things are under threat. Stephanie Simpson, VP, Product Management of SCYTHE had this comment:

Cybercriminals regularly take advantage of new vulnerabilities, especially ones as wide-ranged as Lg4Shell. Critically, most organizations are still in the process of responding to the announcement. They haven’t had adequate time to test their security controls, especially when trying to look for new TTPs using this vulnerability. If we’ve learned nothing from the past year, it’s that organizations are struggling to reduce time to detect and remediate because they don’t have a way to continuously improve people, processes, and technologies.Companies are going to need to assume breach and be proactive over the next few days, and we will likely see an uptick in these attacks through early 2022, at the very least.

Conti aren’t the the only cybercriminals who are leveraging this. Anurag Gurtu, CPO, StrikeReady has this comment about the Khonsari gang who are also leveraging this vulnerability:

Are we witnessing a match made in heaven? Apparently, a ransomware attack is currently exploiting the Log4Shell vulnerability. It’s the Khonsari ransomware gang who has built an attack using C# and the .NET framework. 

After execution, the malware enumerates all mounted drives (other than C:/) and targets user directories including Documents, Videos, Pictures, Downloads, and Desktop. An AES 128 CBC algorithm is used for encryption, and the files are saved with a .khonsari extension.

There are no signs that the Log4Shell vulnerability is slowing down, in fact a second CVE (CVE-2021-45046) just got announced. In the second and third stages, threat actors are aggressively deploying malware families. Among them are Kinsing, XMR, and Mirai. Additionally, some coin-miners and CobaltStrike beacons have been observed in the wild. Nearly 2000 malicious IOCs have been observed so far, which require immediate attention.

We are likely seeing the start of a flood of new attacks leveraging this flaw. So you really need to patch all the things so that you don’t get pwned.