3 ms·
If I understood the vuln correctly, the injected malicious payload makes Log4J download and execute code from attacker's LDAP. I'm thinking that, in serious org
by burntoutfire 5y ago
If I understood the vuln correctly, the injected malicious payload makes Log4J download and execute code from attacker's LDAP. I'm thinking that, in serious organizations, the call to the LDAP just won't make it through the firewall.
- btown 5y agoEven if we assume serious and dedicated security ops at these organizations, the attacker can specify the port to connect to. So any firewall would need to deeply inspect outbound traffic. And plenty of ETL jobs can mix in offsite data e.g. pulling from S3, or even from a hosted LDAP solution, so they wouldn’t prevent outbound traffic. The attacker could even use AWS IPs! As I said, a perfect storm.