{"id":31342,"date":"2022-12-08T11:33:57","date_gmt":"2022-12-08T16:33:57","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/log4shell-still-active-2022\/31342\/"},"modified":"2023-02-14T05:45:02","modified_gmt":"2023-02-13T18:45:02","slug":"log4shell-still-active-2022","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/log4shell-still-active-2022\/31342\/","title":{"rendered":"Log4Shell a year on"},"content":{"rendered":"

A year ago, in December 2021, the Log4Shell vulnerability (CVE-2021-44228) in the Apache Log4j library caused a sensation. Although by the spring it was no longer on the front pages of IT media outlets, in November 2022 it reemerged when it was reported that cybercriminals had exploited<\/a> the vulnerability to attack a US federal agency and install a cryptocurrency miner in its systems. That\u2019s a good reason to explain what Log4Shell actually is, why it\u2019s too early to write it off, and how to protect your infrastructure.<\/p>\n

What is the Apache Log4j library?<\/h2>\n

Because the Java SDK did not initially support logging, developers had to write their own solutions, and by the time the official Java Logging API appeared, there were already quite a few of them. One is Apache Log4j, a popular open-source Java library in development since 2001. It\u2019s by no means the only logging solution in Java, but certainly one of the most popular. Many alternative solutions are essentially offshoots of Log4j that appeared at different stages of the library\u2019s development.<\/p>\n

What is the Log4Shell vulnerability?<\/h2>\n

The Log4j library allows to log all system events automatically. It uses a standard set of interfaces for accessing Java Naming and Directory Interface (JNDI) data. In November 2021, it turned out that during logging it\u2019s able to run JNDI commands passed to it by an event, for example, in the Header field of a request, in a chat message, or in the description of a 404 error on a web page.<\/p>\n

The vulnerability allows<\/a> cybercriminals, at least theoretically, to do whatever they like on the victim\u2019s system (if no additional security measures kick in). In practice, most often attackers used Log4Shell to install illegal miners and carry out ransomware attacks. But there have been more exotic uses for it<\/a> too, including targeted attacks, spreading the Mirai botnet, and even RickRolling \u2014 playing the (annoyingly addictive) \u201cNever Gonna Give You Up\u201d hit by 80s crooner Rick Astley.<\/p>\n

Why is it so dangerous and still a threat?<\/h2>\n

Java is one of the main programming languages; it\u2019s used for many backend systems \u2014 from small corporate servers to industrial automation systems and IoT devices. Most of these systems implement logging in one way or another. For years, the easiest way to do this was to use the Log4j library. When, in December 2021, it was reported to contain a vulnerability, experts declared it would be a huge problem for many years to come<\/a>. Here\u2019s why:<\/p>\n