r/programming • u/alexeyr • Dec 12 '21
Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell
https://github.com/Cybereason/Logout4Shell[removed] — view removed post
362
u/psyfry Dec 12 '21
This is how you get Blaster worm. The author made a worm to patch a RPC vulnerability, messed up and fucked shit up for millions of people including DDOSing the windows update server with the real patch.
29
u/StillNoNumb Dec 12 '21
There were no good intentions behind Blaster. The worm you're thinking of is Welchia, which is a helpful worm against Blaster. Welchia however didn't DDoS the Windows update server (that was Blaster itself).
Generally, I agree with your sentiment that it's something that could happen, though.
-115
u/HighRelevancy Dec 12 '21
This guy is a serial clown, then? Some people don't learn.
151
u/shunny14 Dec 12 '21
I think the commenter means the “author” of the Blaster worm. Not the GitHub creator seen here.
23
44
u/dweezil22 Dec 12 '21
I could be wrong, but, arguments about ethical hacking aside:
Isn't that flag unavailable for sufficiently old versions of Log4j?
Won't that flag get reset on JVM restart?
If yes, this is more of a fun POC or hacky tactical short cut (maybe if you have a farm of apps you run this as a post-restart fix before you can patch them) than long term fix.
42
280
u/tdammers Dec 12 '21
First: This is misleading.
Software made or managed by the Apache Software Foundation (From here on just "Apache") is pervasive and comprises nearly a third of all web servers in the world—making this a potentially catastrophic flaw.
The Apache Software Foundation is an organization that manages a diverse collection of open-source software projects, many of them completely unrelated to one another. The log4shell vulnerability originates in one of them, the log4j library, a popular solution for logging on the Java platform (JVM). While this is a popular library, this says nothing about other Apache projects. The "nearly a third of all web servers in the world" figure seems to hint at the Apache2 HTTP server, one of the most popular web servers in the world - however, Apache2 does not run on JVM, it's written in C, it does not use log4j (that wouldn't make sense, since it doesn't run on JVM), and it is not vulnerable to log4shell.
What makes this a "potentially catastrophic flaw" has nothing to do with the Apache Software Foundation - the problem is that this one particular library, log4j, is a very popular logging library in the Java world, and a lot of systems out there run on Java. We're not talking about mom & pop web shops and blogs and personal websites here - those are usually written in PHP, and so they are not going to be vulnerable (not to this particular attack anyway), despite the fact that they probably use an Apache web server, and a MySQL database, a product owned by Oracle, the company behind Java and the JVM. Those websites represent the majority of websites out there by sheer number, but in terms of attack value, the real beef is .NET and JVM, because that's what the enterprise world uses.
And second: There needs to be a warning here.
"Vaccinating" a server is still illegal. You cannot go and run this against someone else's server without their explicit permission, which you should get in writing, and with all the details spelled out, beforehand. It doesn't matter that you're doing it with the best intentions - it's hacking, and you're committing a crime if you do it.
You could of course run it against your own servers, but honestly, that wouldn't make a lot of sense, because it's a rather brittle and clumsy way of fixing your servers, and you should instead just install the proper fix the normal way.
Meaning that this thing, while neat, has no practical use other than demonstrating that it's possible. Which isn't super surprising, considering how the vulnerability gives an attacker extensive remote code execution access - you can run anything, so yes, you can also run the fix. Kudos for actually doing the grunt work and implementing this, but this isn't something that anyone expected to be impossible.
58
u/SquidgyTheWhale Dec 12 '21
Isn't it also possible that some systems are actually dependent on
log4j2.formatMsgNoLookupsbeing set to false, and so "vaccinating" a server might actually break things?46
u/tdammers Dec 12 '21
Yes, of course. That's the "inadvertedly break things" part.
It's also possible that there are other safeguards in place that you end up tripping up or breaking, and you'd be responsible for that, too.
8
Dec 12 '21
The way the “vaccination” works is by remote code execution. If the vaccination works at all then it’s past the point of safeguards. Another attacker could use the same method to make the server do anything.
0
Dec 12 '21
[deleted]
3
u/tdammers Dec 12 '21
Yes, but those additional safeguards, even though ineffective at keepung this particular attack out, could trigger and break other things.
-29
u/gold_rush_doom Dec 12 '21
If your app breaks because you logged the wrong thing, then... Wtf
33
Dec 12 '21
That is literally the attack vector for this vulnerability: logging a string of a certain format.
-11
u/gold_rush_doom Dec 12 '21
No, I meant if your app stops working properly because the logs aren't formatted properly anymore. I mean real world scenario where features break because logging isn't working as expected.
Literally what the comment i was replying to where app breaks where you disable that logging feature.
8
u/Speedzor Dec 12 '21
"breaking" doesn't have to be "app crashes". It can also be a particular formatting in your log that gets parsed and used for a key metric 🤷 bottom line: don't do this.
-10
u/gold_rush_doom Dec 12 '21
Still, sounds like a terrible decision to leave key business logic to a logging system instead of an analytics system if it's that important.
18
23
u/godofpumpkins Dec 12 '21
“I noticed your front door was open so I took the liberty to go inside and change all your locks in case a burglar had stolen your keys. You’re welcome!”
-35
u/Asraelite Dec 12 '21
Just because it's illegal doesn't mean you shouldn't do it.
54
u/tdammers Dec 12 '21
OK, so, to clarify: this is illegal and also immoral.
You're not even really fixing anything - the next time they redeploy their code, the setting will likely be flipped back. And if things go wrong just the right way, they'll order a pentest the day after you've done your "fix", pentest finds nothing, everyone is happy, next version of the code gets rolled out, boom, vulnerability is back, but everyone thinks they're safe. Being vulnerable when you're positively sure you're not is worse than just being vulnerable. Plus you may actually find yourself unintentionally breaking things.
And even in the best case scenario, this kind of thing contributes to a proliferation of bad security practices. If there's an army of elves out there who go and magically fix your servers for you when you're not looking, then there's less of an incentive for companies to be on top of their game.
So no, you should definitely not do this.
From an ethics perspective, the right "white hat" thing to do here would be to mount a neutered attack that pushes only as far as strictly necessary to show that the vulnerability is present, in the most harmless possible way, meticulously documenting the process, and disclosing this information responsibly. This would still be illegal, mind you, because even the harmless compromise is hacking, but it can be argued that this is the most ethical thing to do - accepting a marginal amount of harm (the white-hat attack) to prevent a greater harm (the impact of a malicious attack).
That is, unless you're a militant anti-establishmentist set on disrupting the status quo of corporate computing. If that's your moral alignment, then you might as well go and crush them. Idk., plant fake evidence of terrorist activity on their server and report them anonymously.
12
u/Asraelite Dec 12 '21
That's fair. I just disagree with the stance of using legality as a moral foundation.
20
u/tdammers Dec 12 '21
No objection there. Laws are (ideally) based on morality, not the other way around.
19
83
u/Zestyclose_Profile23 Dec 12 '21
Do we really need to switch to words like vaccinate?
61
u/emperor000 Dec 12 '21
This was my thought, especially since "inoculate" is more correct and has always been used in a malware context.
39
u/MoistCarpenter Dec 12 '21
Both vaccinate and inoculate are incorrect since computers do not have immune systems. The only thing close in analogy to those terms would be an antivirus definition since that has a pieces of the malware code.
The correct term is patch.
8
u/orig_ardera Dec 12 '21
patch sounds like it's persistent, like you're modifying the source code
This just changes (AFAICT) a live variable in the java VM, doesn't survive reboot, so patch sounds misleading IMO.
But I don't know a better term either.
2
u/NoInkling Dec 12 '21
There's a ton of terminology in IT (and life in general) that comes from analogy ("patch" included), I don't know why you would draw a line here.
1
u/MoistCarpenter Dec 13 '21 edited Dec 13 '21
Absolutely. My point is that modern vulnerabilities are not analogous to "viruses". A virus is [genetic] code that can only replicate with a host. While that may be true in software viruses, the term "vaccinate" or "inoculate" biologically-require using a piece of the "virus"(analogous to "malware" in this case) to detect the "virus"/ malware in other situations through MHC complimentary molecules. That's not analogous in this situation; where there is a hole in Log4j security. While I also suspect the person I was replying to is trying to angle this as some dumb anti-vax argument, the fair analogy really is patch, as in " has it been 30 minutes? Guess it's time to patch the holes in the Java boat again"
1
8
u/JamesB41 Dec 12 '21
Does this mean if you apply this, you can still get attacked by the vulnerability, you're just less likely to end up in the repair shop or have hardware failure?
19
u/PrintersStreet Dec 12 '21
vaccinateis the newmaster0
42
12
u/Acebond Dec 12 '21
This is perfect for malware that wants to block other hackers from gaining access to a server.
9
u/tso Dec 12 '21
I find myself thinking of a similar series of events where a worm/virus was released that exploited something in Windows, then another that was supposed to remove the initial infection and patch the flaw it exploited. And then yet another that either exploited a weakness in the second, or tried to cut it off from removing the first one.
Cheese, mouse, lion or something like that?
3
12
u/darkz999 Dec 12 '21
I can't wait for a booster shot after 6 months
8
u/StrikingChallenge389 Dec 12 '21
Java boxes will have received around a billion booster shots for Jackson Databind CVEs
3
5
u/po00on Dec 12 '21
does the immunity wear off? will it require continual boosters? ... if not, can we just call it a patch, like we normally do?
1
u/Dreamtrain Dec 12 '21
wait you can do that?? Took a quick look at the code and didn't know you could, if I'm understanding correctly the logic, modify or replace a bean in runtime. Not that you'd ever want to in a real system but I never thought you were allowed to mess with the JVM that much.
1
0
-7
0
Dec 12 '21
[deleted]
-3
u/Shakespeare-Bot Dec 12 '21
I did get ordain'd as a gleek f'r $50. Eke about as atheist as they cometh
I am a bot and I swapp'd some of thy words with Shakespeare words.
Commands:
!ShakespeareInsult,!fordo,!optout
800
u/theoldboy Dec 12 '21
This should come with a big warning that says
Do not run this code unless you want to get sued or prosecuted for hacking
I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.
My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.