Connect with us

Cyber Security

Understanding and Preventing the Log4j Exploit and Botnets



Written by Amr Alashaal, Regional Vice President – Middle East at A10 Networks

Of all the security issues that have appeared over the last few years, none has had the impact of the Log4j exploit. Also called the Log4Shell, it was reported to the developers, the Apache Software Foundation, on 24 November, 2021, by the Chinese tech giant Alibaba and it took two weeks to develop and release a fix.

The existence of the Log4j exploit was first publicly published in a tweet by Chen Zhaojun, a cyber security researcher with the Alibaba Cloud Security team on December 9, 2021 and formally announced by the U.S. Institute of Standards (NIST) under identifier CVE-2021-44832 on December 10, 2021 with a follow-up reanalysis, CVE-2021-45046, published on December 14, 2021. The Apache Software Foundation gave the exploit the highest Common Vulnerability Scoring System severity rating of 10.

The exploit allowed cyber threat actors to mount remote code execution (RCE) attacks on the widely used Apache Log4j Java logging library. An RCE exploit allows an attacker to run whatever code they please on a remote device. In the case of the Log4Shell vulnerability, which was particularly easy to exploit, successful execution allows the attacker to obtain full access to the computer.

What is Log4j?
Log4j is a subsystem for recording events such as error and status reports, an important component of modern applications. Developed by the Apache Software Foundation, Log4j is a free, open-source software package (also referred to as “FOSS”) written in Java. First released on January 8, 2001, the package became a foundational component of an extremely large number of projects due to its lightweight and easy to use characteristics.

How Does the Log4j Vulnerability Work?
The Log4j vulnerability is due to the use of the Java Naming and Directory Interface (JNDI), which allows additional Java objects from remote naming services during runtime execution. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) were all vulnerable to Log4Shell. The first completely fixed Logj4 release was version 2.17.0, published on December 17, 2021.

To mount an attack, cyber threat actors send web servers specially crafted HTTP/HTTPS requests to log an event that includes a JNDI request in the header that might get logged as, for example, a user-agent string:

If the attacker is lucky, the server passes the user-agent string to Log4j to be logged. Log4j interprets the string and, finding a JNDI request, queries the specified LDAP server. This is where the problem lies in vulnerable versions of Log4j because of inadequate verification and “cleaning” of the request. The LDAP server, which is controlled by the attacker, responds with directory data that contains the malicious Java object. The data is received by the server and executed and the system gets compromised.

How Bad is the Log4j Exploit?
Some of the most notable services affected by the vulnerability included Cloudflare, iCloud, Minecraft: Java Edition, Steam, Tencent QQ, and Twitter. Cloudflare’s CEO, Matthew Prince, tweeted on December 11, “Earliest evidence we’ve found so far of #Log4J exploit is 2021-12-01 04:36:50 UTC. That suggests it was in the wild at least 9 days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.”

Of course, after public disclosure, cyber threat actors swung into action. An article posted on the Google Security blog updated nine days after the Log4Shell vulnerability was announced, wrote that “The ecosystem impact numbers for just log4j-core [the Apache Log4j Implementation], as of 19th December are over 17,000 packages affected, which is roughly 4 % of the ecosystem. 25% of affected packages have fixed versions available.” As the Google article pointed out, that was the proverbial “tip of the iceberg” because those packages were used by other packages resulting in over 35,000 Java packages being vulnerable.

The Google blog post also pointed out that “For greater than 80% of the packages, the vulnerability is more than one level deep, with a majority affected five levels down (and some as many as nine levels down). These packages will require fixes throughout all parts of the tree, starting from the deepest dependencies first.”

The reason Log4j became such a big deal was due to the enormous number and popularity of products that used the library; hundreds of millions of devices were, and many still are, affected as a consequence. A contemporaneous article in The Guardian described the vulnerability as “a major threat to organizations around the world” and noted that it “may be the worst computer vulnerability discovered in years.” Those assertions proved to be correct.

In mid-December 2021 Glen Pendley, deputy chief technology officer at Tenable, commented, “[the Log4Shell vulnerability] … is in a league above every other vulnerability we’ve seen in the last few decades. It gives flaws like Heartbleed and Shellshock, a run for their money because of just how pervasive and devastating it is. Everything across heavy industrial equipment, network servers, down to printers, and even your kid’s Raspberry Pi is potentially affected by this flaw. Some affected systems may be on-premises, others may be hosted in the cloud, but no matter where they are, the flaw is likely to have an impact. Cybercriminals are already rubbing their hands with glee as early signs of ransomware activity have started to emerge. The worst part is, we aren’t even in the thick of it yet. Don’t be surprised when some major disruptions occur over the next few weeks and months, pointing at Log4j as the root cause.”

The bottom line is that the Log4Shell vulnerability is a systemic problem due to its appearance in tens of thousands of libraries used by thousands of programs. The resulting complexity makes fixing enterprise-class applications very difficult. A list of applications affected by Log4j can be found on GitHub.

Who’s Using the Log4j Exploit and How?
Once the Log4j vulnerability was publicly announced, multiple cyber threat actors immediately began to use it. For example, starting on December 15, 2021, an Iranian state-sponsored hacking group named Charming Kitten or APT35 launched multiple attacks against Israeli government and business sites trying to exploit the Log4j vulnerability.
While attacks using the Log4Shell vulnerability can be effective for state actors focused on specific politically targeted websites, the really dangerous use of the exploit is when botnets perform large scale scanning for vulnerable sites to create crypto mining and DDoS platforms. Given that there are still millions of unpatched sites using out of date Log4j code, it’s fertile ground for hackers.

As early as December 2021, security researchers identified Mirai botnets adopting the Log4j vulnerability to suborn IoT devices including IP cameras, smart TVs, network switches, and routers. Since then two botnets, Elknot (also known as the BillGates trojan) and the Gafgyt (AKA BASHLITE), have also been detected using the Log4j exploit.

A relatively new malware named B1txor20 by researchers at Qihoo 360’s Network Security Research Lab also exploits the Log4j vulnerability. The malware, which deploys backdoors, SOCKS5 proxy, malware downloading, data theft, arbitrary command execution, and rootkit installing functionality was first identified in March of 2022 and attacks Linux ARM, X64 CPU architecture devices. Using the Log4j exploit, the malware infects new hosts and uses DNS tunneling to receive instructions and exfiltrate data to and from the botnet’s command and control servers. Fortunately, B1txor20 has non-functional features and is buggy but, of course, the cyber threat actors behind the malware are expected to fix and improve the software.

How to Prevent Log4j Exploits
There are four ways that enterprise cyber security teams can prevent Log4j exploits in vulnerable systems:

  1. Upgrade or disable Log4j libraries. As noted earlier, fixing enterprise-scale applications while minimizing service downtime can be an engineering nightmare.
  2. Deploy a web application firewall (WAF) to filter out unauthorized sources and content such as JNDI requests from unknown IP addresses.
  3. Disable JNDI lookups.
  4. Disable the loading of remote Java objects.

Cyber Security

Cybersecurity Collaboration Holds Immense Significance in Today’s Threat Landscape



Ertug Ayik, the VP and MD of Middle East and Africa at HP, speaks about the security threat landscape in the region and what companies can do to keep these threats at bay

Tell us about the security threat landscape in the region. How has it evolved over the years?
The security threat landscape in our region, like many others, has evolved significantly over the years. We have witnessed a shift from primarily isolated attacks to a complex and interconnected threat landscape. Threat actors are becoming more sophisticated, and attacks are increasingly targeted and financially motivated.

Emerging technologies, such as IoT and cloud computing, have introduced new attack vectors. The shift to the cloud has also made cybercrime easier, cheaper, and more profitable. Traditional security measures have focused on detecting malware to prevent attackers from gaining access to critical systems. Over the last year, we have seen signs of increased development and trading capabilities – from tools to hack BIOS passwords, to rootkits and trojans targeting device firmware.

Organizations must adapt to this dynamic environment by implementing proactive security measures and staying informed about evolving threats. Increased resiliency, meaning, the ability to respond to hackers who have managed to exploit a vulnerability, is key.

What sort of role does the security community play in countering cyber threats?
The security community plays a crucial role in countering cyber threats. It serves as a collective defence mechanism against the ever-evolving threat landscape. Security professionals, researchers, organizations, and governments collaborate to share threat intelligence, insights, and best practices. This collaboration fosters a deeper understanding of emerging threats, enables rapid response to incidents, and enhances detection and mitigation capabilities.

Additionally, the security community contributes to raising awareness about cybersecurity and promoting proactive defence strategies. HP Sure Click, one of our key security solutions, not only protects users from various cyberattacks but also contributes to this collaborative ecosystem. Its containment-based approach enables us to capture and analyse malware execution traces, providing valuable insights to the security community. Collaboration with industry experts and leveraging threat intelligence providers empower us at HP to better identify and evaluate emerging threats before they pose significant risks.

Tell us about HP’s HP Sure Click. How does it help in keeping security threats at bay?
HP Sure Click is a groundbreaking security solution that plays a pivotal role in safeguarding against security threats. It leverages cutting-edge micro-virtual machine technology to create secure environments for handling untrusted content. By isolating potentially malicious activities within these secure micro-VMs, HP Sure Click prevents threats from spreading to other parts of a network.

HP Sure Click goes beyond safeguarding web browsers; it extends its protection to cover documents like PDFs and Microsoft Office files. This approach ensures that even if a file is compromised, the malware within it remains contained and cannot infect the user’s device. HP Sure Click also quantifies risks by recording how users encounter threats, whether through email attachments, browser downloads or clicking on links.

These insights reduce known risks and may even uncover previously unknown risky user behaviours that can be addressed at an organizational level. HP Sure Click automatically maps attack attempts to MITRE ATT&CK, an industry knowledge base that enables organizations to understand the techniques that attackers are using against their organizations and prioritize their defences based on the threats they face.

By employing HP Sure Click, organizations can proactively defend against malware attacks, enhance their cybersecurity posture, and maintain a secure computing environment.

What are the significance and benefits of cybersecurity collaboration in terms of public reporting, sharing analysis tools, and collaborating within trust groups to enhance collective knowledge and response capabilities?
Cybersecurity collaboration holds immense significance in today’s threat landscape. We all have different vantage points of the threat landscape so by engaging in collaborative efforts such as public reporting, sharing analysis tools, and participating in trust groups, the security community amplifies its collective knowledge and response capabilities. This approach helps in several ways.

Firstly, public reporting of cyber threats raises awareness and allows organizations to tackle emerging threats proactively. Secondly, the sharing of analysis tools accelerates the identification and response to cyberattacks, enabling faster mitigation. Thirdly, trust groups foster a sense of shared responsibility, trust, and mutual support within the security community. Collaboration within these groups promotes a more coordinated and effective response to threats.

HP recognises the importance of such collaboration and actively contributes to the security community by sharing insights and analysis through research and publications.

What are the challenges of cybersecurity collaboration, and can these be overcome?
In the realm of cybersecurity collaboration, we encounter a multitude of challenges that demand careful consideration. The foremost among these challenges is the reluctance to share sensitive information due to concerns about data privacy and security. However, to effectively counteract evolving threats, it is important that organizations overcome this hurdle by anonymizing data and following robust security protocols for information exchange. Organisations can consider participating in collaboration platforms that ensure confidentiality while also implementing clear legal and governance frameworks designed to protect shared information.

Building trust requires establishing strong relationships among all parties. Another formidable challenge lies in the allocation of resources required for seamless collaboration. Coordinating efforts across diverse entities can be resource-intensive, necessitating efficient resource pooling and allocation. To surmount these challenges, industry groups can play a pivotal role in facilitating collaboration and distributing resources effectively. Moreover, the establishment of standardized legal agreements can provide a solid foundation for secure information sharing.

Ultimately, the cornerstone of successful cybersecurity collaboration rests on trust. Fostering trust among collaborators is an ongoing process that hinges on transparent communication, the diligent protection of shared data, and a unified commitment to bolstering collective security efforts. By addressing these challenges head-on, we can collectively fortify our defences against the relentless evolution of cyber threats.

Continue Reading

Cyber Security

42 Abu Dhabi Hosts Coding Hackathon in Collaboration with Al Hathboor



42 Abu Dhabi, the UAE capital’s innovative and disruptive coding school that provides a unique peer-to-peer, gamified learning methodology, held a hackathon titled “AI See a Solution: Computer Vision Hackathon 2023” from 13-14 September. The hackathon was held in collaboration with Al Hathboor, a cutting-edge solutions provider dedicated to spearheading technological advancements for businesses and governments.

This two-day hackathon aimed to foster innovation and creativity among students by challenging them to harness the power of coding to solve real-world problems using AI. The event kicked off with a workshop on the first day, focusing on Computer Vision using Python Frameworks, Python Libraries, Open-source Models, and Datasets. Through the workshop, students gained valuable insights and skills essential for the hackathon, ensuring they are equipped to tackle the challenge ahead.

The team that won first place, including Ahmed Salem, Ghaiath Abdoush, Shatha Jadallah and Nousheen Ali, developed ‘Sawt AlRu’ya,’ an application which utilizes cutting-edge computer vision and AI technology to analyze live video streams, convert them into real-time textual descriptions, and seamlessly translate them into spoken words using a Large Language Model (LLM). By providing immediate audio feedback, ‘Sawt AlRu’ya’ empowers individuals with visual impairments to interact with their surroundings, effectively enhancing their daily lives and fostering inclusivity.

The second-place champions, including Avazbek Rashidov, Timur Mazitov, Zubaydullo Abdirakhmonov, and Nauman Munir, developed “Visulaw”, a tool which empowers users to capture photos of objects and instantly receive location-specific information about relevant fines and laws associated with those objects. This web application enhances user awareness and compliance with local regulations, fostering safer and more informed interactions with everyday objects.

Marcos Muller Habig, Acting CEO of 42 Abu Dhabi, said, “We were thrilled to host the hackathon in collaboration with Al Hathboor, which served as an opportunity for our students to showcase their talents and unleash their creativity. The hackathon empowered 42 Abu Dhabi’s students to leverage their coding skills to develop advanced technologies which can drive meaningful change within the community. This cements our leading position as a talent incubator that is upskilling a new generation of coders who are equipped to accelerate the Emirate’s digital transformation and make a positive impact on society.”

Raj Sandhu, General Manager of Al Hathboor, said, “We at Al Hathboor are proud to collaborate with 42 Abu Dhabi in spearheading technological advancements through coding and practical sciences. AHB is pleased to be part of the very first Computer Vision hackathon in collaboration with 42 Abu Dhabi. We extend our appreciation to the participants and 42 Abu Dhabi Faculty’s unwavering support, and we look forward to future collaboration opportunities.”

Continue Reading

Cyber Security

Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape



Since early 2023, Proofpoint has observed an increase in the email distribution of malware associated with suspected Chinese cybercrime activity. This includes the attempted delivery of the Sainbox Remote Access Trojan (RAT) – a variant of the commodity trojan Gh0stRAT – and the newly identified ValleyRAT malware. After years of this malware not appearing in Proofpoint threat data, its appearance in multiple campaigns over the last six months is notable.

The phrase “Chinese-themed” is used to describe content related to this malicious activity, including lures, malware, targeting, and metadata that contains Chinese language usage. Campaigns are generally low-volume and are typically sent to global organizations with operations in China. The email subjects and content are usually written in Chinese and are typically related to business themes like invoices, payments, and new products. The targeted users have Chinese-language names spelled with Chinese-language characters, or specific company email addresses that appear to align with businesses’ operations in China. Although most campaigns have targeted Chinese-speaking users, Proofpoint observed one campaign targeting Japanese organizations, suggesting a potential expansion of activity.

These recently identified activity clusters have demonstrated flexible delivery methods, leveraging both simple and moderately complex techniques. Commonly, the emails contain URLs linking to compressed executables that are responsible for installing the malware. Proofpoint has also observed Sainbox RAT and ValleyRAT delivered via Excel and PDF attachments containing URLs linking to compressed executables.

Research into additional activity clusters utilizing this malware demonstrates enough variety in infrastructure, sender domains, email content, targeting, and payloads that researchers currently conclude that all use of these malware and associated campaigns are not attributable to the same cluster, but likely multiple distinct activity sets.

The emergence and uptick of both novel and older Chinese-themed malware demonstrates a new trend in the overall 2023 threat landscape. A blend of historic malware such as Sainbox – a variant of the older Gh0stRAT malware – and the newly uncovered ValleyRAT may challenge the dominance that the Russian-speaking cybercrime market has on the threat landscape. However, the Chinese-themed malware is currently mostly targeted toward users who likely speak Chinese. Proofpoint continues to monitor for evidence of increasing adoption across other languages.

With this resurgence of Chinese-themed malware, the question arises: is the impact of older malware easier to detect due to its age? Does mature detection always mean mature security? Based on Proofpoint’s analysis, the answer is not necessary, as older malware can still be effective, especially when threat actors constantly change tactics by rotating IPs, domains, encoding, and obfuscation. Consequently, even though these malware families are not new, organizations cannot afford to underestimate the risk they pose.

Proofpoint research suggests that this activity does not seem to be related to a single entity but rather appears to be a cluster of activities based on temporal patterns. The appearance of ValleyRAT alongside the older families hints at the possibility of their relationship in terms of timing. Proofpoint anticipates ValleyRAT will be used more frequently in the future.

Raising awareness in 2023 about the reappearance of these threats serves as an informational bulletin for the community. While new and sophisticated threats seemingly dominate the daily threat landscape, it is essential to maintain a balanced perspective by acknowledging seemingly less significant risks that persist. Despite being neither new nor advanced, Sainbox RAT still poses a threat in 2023, and ValleyRAT is an emerging threat in this space.

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.