4 ms·

Are there any notable systems exploited by this besides minecraft?

by ronnier 5y ago

klysm 5y ago
Unifi systems is a pretty bad one
- artificialLimbs 5y ago
  UBNT says the Unifi Network app is unaffected, but they are patching "out of an abundance of caution"... whatever that means.
eganist 5y ago
you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected. I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected. And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely. Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.
- tyingq 5y ago
  There's also a tendency for a lot of Cybersecurity type software to use java and log4j. Things like SAML, SSO, code scanning, etc. I'm fighting a bit of schadenfreude watching all of those vendors furiously trying to get their stories together.
tyingq 5y ago
Many, many of them. See the gist posted in another comment: https://news.ycombinator.com/item?id=29543439 https://news.ycombinator.com/item?id=29543439 Though even that long list is missing many. I have lots of emails in my inbox from various software vendors that are NOT listed in that Gist. It's probably easier to compile a list of software you use that uses java, then the short of those projects that DON'T use log4j.
staticassertion 5y ago
It's still very early, we won't have breach notifications for a while since any attacks would have started in the last few weeks at the earliest, and most would have started last week.
- cmelbye 5y ago
  It’s possible that it was exploited before the issue was widely discovered, right? I thought it had been in there for a while.
  - bostik 5y ago
    IIRC Cloudflare said the earliest they had seen this being exploited in the wild was very early December, but the volume went up after Friday.
  - staticassertion 5y ago
    It's entirely possible and it's still so early that we're still guessing. But so far some companies have come out to say that they've seen exploitation only as early as a few weeks ago. Companies likely only started IR in the last week. Breach notifications, which only a minority of companies will bother to send out, will be a few weeks away at the earliest.
swarnie 5y ago
My ERP, PLM and MRO vendors are all still investigating..... I suspect we'll be patching quickly before Christmas.
justupvoting 5y ago
Kronos private cloud. Wouldn't be surprised to see disruption to UKG. https://community.kronos.com/s/feed/0D54M00004wJCdJSAW?language=en_US https://community.kronos.com/s/feed/0D54M00004wJCdJSAW?langu...
artificialLimbs 5y ago
https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970...

Are there any notable systems exploited by this besides minecraft?

klysm 5y ago

Unifi systems is a pretty bad one

artificialLimbs 5y ago
UBNT says the Unifi Network app is unaffected, but they are patching "out of an abundance of caution"... whatever that means.

eganist 5y ago

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected. I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected. And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely. Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.

tyingq 5y ago
There's also a tendency for a lot of Cybersecurity type software to use java and log4j. Things like SAML, SSO, code scanning, etc. I'm fighting a bit of schadenfreude watching all of those vendors furiously trying to get their stories together.

tyingq 5y ago

Many, many of them. See the gist posted in another comment: https://news.ycombinator.com/item?id=29543439 https://news.ycombinator.com/item?id=29543439 Though even that long list is missing many. I have lots of emails in my inbox from various software vendors that are NOT listed in that Gist. It's probably easier to compile a list of software you use that uses java, then the short of those projects that DON'T use log4j.

staticassertion 5y ago

It's still very early, we won't have breach notifications for a while since any attacks would have started in the last few weeks at the earliest, and most would have started last week.

cmelbye 5y ago
It’s possible that it was exploited before the issue was widely discovered, right? I thought it had been in there for a while.
- bostik 5y ago
  IIRC Cloudflare said the earliest they had seen this being exploited in the wild was very early December, but the volume went up after Friday.
- staticassertion 5y ago
  It's entirely possible and it's still so early that we're still guessing. But so far some companies have come out to say that they've seen exploitation only as early as a few weeks ago. Companies likely only started IR in the last week. Breach notifications, which only a minority of companies will bother to send out, will be a few weeks away at the earliest.

swarnie 5y ago

My ERP, PLM and MRO vendors are all still investigating..... I suspect we'll be patching quickly before Christmas.

justupvoting 5y ago

Kronos private cloud. Wouldn't be surprised to see disruption to UKG. https://community.kronos.com/s/feed/0D54M00004wJCdJSAW?language=en_US https://community.kronos.com/s/feed/0D54M00004wJCdJSAW?langu...

artificialLimbs 5y ago

https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970...