4 ms·

Another eli5 request: as a home user or a mobile phone user, do I have anything to worry about? Is there some kind of query/search I can do on my own computer

Another eli5 request: as a home user or a mobile phone user, do I have anything to worry about? Is there some kind of query/search I can do on my own computer to see if any application has integrated log4j?

markbnj 5y ago
I'm not a security expert. I spent a good chunk of time yesterday mitigating this with our security people so I have a decent overview of the bug and how it's exploited. If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you. Take this as inexpert guidance until someone more authoritative chimes in. The vector of vulnerability here is user content getting into log messages, as can happen if you log headers from user connections for example.
- cesarb 5y ago
  > If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you. The direction of the connection isn't relevant. For instance, when you are playing Minecraft and connect to a server, the connection starts from inside your network, but could be used to attack your Minecraft client.
- VectorLock 5y ago
  >others can connect to from outside your network Doesn't exactly cover it. Strings, uh, find a way.
- reginaldo 5y ago
  Actually, the surface of attack is larger. It is: the machine receives strings from a service that's been connected to the internet somehow and the machine itself server can connect to the internet. A non-obvious example would be logs/data that will be processed by Solr.
rst 5y ago
It's been widely reported that iCloud is exploitable (by setting your phone's name to something that includes the "${jndi:ldap://...}" incantation), so if you're using an iPhone, cloud services you use may have been compromised. Haven't seen an assessment yet of exactly what's at risk from that. Also haven't seen much about Android apps using log4j -- depending on how (and whether) Android's nonstandard library handles JNDI, this may be mitigated, but stay tuned. As to home PCs -- if you're running anything written in Java which logs strings under somebody else's control (email subject lines, to cite one potentially plausible example), well... they might be able to run code on your box.
- planb 5y ago
  It's not clear if iCloud is exploitable. Just the DNS lookups do not prove that remote code execution via ldap is active. In fact, if they are using an up to date JRE, it's not. I tried to exploit my own apps and could only get it to work when setting com.sun.jndi.ldap.object.trustURLCodebase to true

markbnj 5y ago

I'm not a security expert. I spent a good chunk of time yesterday mitigating this with our security people so I have a decent overview of the bug and how it's exploited. If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you. Take this as inexpert guidance until someone more authoritative chimes in. The vector of vulnerability here is user content getting into log messages, as can happen if you log headers from user connections for example.

cesarb 5y ago
> If you aren't running an application on your home server or phone that others can connect to from outside your network then this isn't likely an issue for you. The direction of the connection isn't relevant. For instance, when you are playing Minecraft and connect to a server, the connection starts from inside your network, but could be used to attack your Minecraft client.
VectorLock 5y ago
>others can connect to from outside your network Doesn't exactly cover it. Strings, uh, find a way.
reginaldo 5y ago
Actually, the surface of attack is larger. It is: the machine receives strings from a service that's been connected to the internet somehow and the machine itself server can connect to the internet. A non-obvious example would be logs/data that will be processed by Solr.

rst 5y ago

It's been widely reported that iCloud is exploitable (by setting your phone's name to something that includes the "${jndi:ldap://...}" incantation), so if you're using an iPhone, cloud services you use may have been compromised. Haven't seen an assessment yet of exactly what's at risk from that. Also haven't seen much about Android apps using log4j -- depending on how (and whether) Android's nonstandard library handles JNDI, this may be mitigated, but stay tuned. As to home PCs -- if you're running anything written in Java which logs strings under somebody else's control (email subject lines, to cite one potentially plausible example), well... they might be able to run code on your box.

planb 5y ago
It's not clear if iCloud is exploitable. Just the DNS lookups do not prove that remote code execution via ldap is active. In fact, if they are using an up to date JRE, it's not. I tried to exploit my own apps and could only get it to work when setting com.sun.jndi.ldap.object.trustURLCodebase to true