|
Did you check your PATH?
|
#
?
Dec 11, 2021 04:25
|
|
|
|
| # ? May 25, 2024 18:22 |
|
|
Nothing Javaish there.
|
|
#
?
Dec 11, 2021 04:50
|
|
|
Love spending friday night shutting down servers as that is the direction we have been given! Going to be a fun weekend!
|
|
#
?
Dec 11, 2021 04:51
|
|
|
Are there any details on the vulnerability for 1.x? Especially around say any sort of equivalent properties to log4j2.formatmsgnolookups that could be set to mitigate the issue. Yes it's been EOL for a mere 6 years, but we can't be bothered to upgrade.
|
|
#
?
Dec 11, 2021 05:28
|
|
|
Nukelear v.2 posted:Are there any details on the vulnerability for 1.x? Especially around say any sort of equivalent properties to log4j2.formatmsgnolookups that could be set to mitigate the issue. If you want to believe this: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 Then it should not be impacted, probably the most official thing you will get. We only shutdown stuff with 2.x running.
|
|
#
?
Dec 11, 2021 05:34
|
|
|
I'm just going to continue as usual and if I get hacked they can see what kind of hosed up porn I watch and demand I pay 0.05BTC to decrypt all the pictures I save from the funny pictures thread.
|
|
#
?
Dec 11, 2021 05:39
|
|
|
Dread Head posted:If you want to believe this: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126 I want to believe. Appreciate it, I totally missed ceki's post on that page.
|
|
#
?
Dec 11, 2021 05:49
|
|
|
The log4j vulnerability was known of for 5 years https://twitter.com/th3_protoCOL/status/1469644923028656130?t=YQpiCqm6xn1Q4S3X0657kg
|
|
#
?
Dec 11, 2021 15:54
|
|
|
Maybe I missed this thru the posting but if you decided to nerd out and have a unifi controller hosted on the cloud or exposed to the web in any way, upgrade to 6.5.54 immediately, any other build is vulnerable to this log4j vuln.
|
|
#
?
Dec 11, 2021 16:08
|
|
|
Fart Amplifier posted:The log4j vulnerability was known of for 5 years lol
|
|
#
?
Dec 11, 2021 17:42
|
|
|
Ugh Friday was so exhausting with this stupid log4j poo poo
|
|
#
?
Dec 11, 2021 20:11
|
|
|
I'm being called into comms bridges today, so much for a relaxing weekend after a lovely Friday.
|
|
#
?
Dec 11, 2021 20:13
|
|
|
8am in the morning yesterday I pinged our infrastructure team about Log4J. They said that we were fine. 2 hours later they start really digging in and going "ok poo poo, we aren't fine." 11am a conference bridge starts, and I was included on it. 8pm last night the bridge finally ended. My boss sent me a $50 doordash gift card for my hard work. Yay!
|
|
#
?
Dec 11, 2021 20:16
|
|
|
Yeah already had to deal with two clients who got popped and had cryptominers installed. Its gonna be a long weekend.
|
|
#
?
Dec 11, 2021 20:49
|
|
|
Hello weekend crew dealing with log4j. Spending the weekend shutting things down and waiting to see how long vendors will take to provide patches!
|
|
#
?
Dec 11, 2021 20:52
|
|
|
Dread Head posted:Hello weekend crew dealing with log4j. Spending the weekend shutting things down and waiting to see how long vendors will take to provide patches! We asked the Exec team to sign off on shutting down non-critical apps. Got told no.
|
|
#
?
Dec 11, 2021 20:57
|
|
|
The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: hard for 10.0s
|
|
#
?
Dec 11, 2021 21:10
|
|
|
Fart Amplifier posted:The log4j vulnerability was known of for 5 years Should've come up with a name and a hashtag 
|
|
#
?
Dec 11, 2021 21:37
|
|
|
I'd say the NSA probably had fun with that, but the NSAs own Ghidra tool was vulnerable lol
|
|
#
?
Dec 11, 2021 21:38
|
|
|
CommieGIR posted:We asked the Exec team to sign off on shutting down non-critical apps. Got told no. We have shut down any MC apps that will not result in danger to users (we managed a few that fall into this area) on top of non MC apps. The biggest shock is how many things still use 1.x version of those even though it was EOL back in 2015, many of those are bundled in middle ware from vendors (adobe etc) so not trivial to update those if you can't wait for a patch from said vendor...
|
|
#
?
Dec 11, 2021 21:45
|
|
|
24 hours after all the SIS systems in the province are found to be trivially hackable Maybe you can start by taking people offline you dorks
|
|
#
?
Dec 11, 2021 21:49
|
|
|
Got everything patched by 3:30am. Yay infrastructure as code and automation!
|
|
#
?
Dec 11, 2021 22:39
|
|
|
Fart Amplifier posted:Honest question, how do you know you're not running Java?  Television sets, parking meters, telephones, cars, birdcages, cheese graters, battleships, and pants. 
|
|
#
?
Dec 11, 2021 22:52
|
|
|
Powered Descent posted:
pygmies, budgies, kuala lumpur
|
|
#
?
Dec 11, 2021 22:54
|
|
|
Dread Head posted:Hello weekend crew dealing with log4j. Spending the weekend shutting things down and waiting to see how long vendors will take to provide patches! 16 hours on and still rolling! I'll just say I have a new respect for a well-maintained intrusion detection/prevention suite. This morning ours started lighting up like a Christmas tree with blocked log4j attacks, and while we took pretty quick action on remediating once the vulnerability was widely reported, I have to wonder how much grief it saved us.
|
|
#
?
Dec 12, 2021 06:03
|
|
|
https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 ^^ vendor response cheat sheet for this nonsense
|
|
#
?
Dec 12, 2021 15:49
|
|
|
WhiteHowler posted:16 hours on and still rolling! What suite do you use? Nothing speaks like working in a real world event.
|
|
#
?
Dec 12, 2021 17:18
|
|
|
repiv posted:I'd say the NSA probably had fun with that, but the NSAs own Ghidra tool was vulnerable lol The public version, at least!
|
|
#
?
Dec 12, 2021 18:18
|
|
|
Subjunctive posted:The public version, at least! That's interesting. In a hypothetical world, if they knew their tool was compromised before the majority heard of this vulnerability, they could have exploited the users that downloaded it?
|
|
#
?
Dec 12, 2021 18:58
|
|
|
Hughmoris posted:That's interesting. In a hypothetical world, if they knew their tool was compromised before the majority heard of this vulnerability, they could have exploited the users that downloaded it? I mean, I don’t know of evidence that they would, but the set of people who use Ghidra are probably pretty interesting to the NSA.
|
|
#
?
Dec 12, 2021 19:43
|
|
|
Subjunctive posted:I mean, I don’t know of evidence that they would, but the set of people who use Ghidra are probably pretty interesting to the NSA. Isn't the evidence the fact that they are the NSA?
|
|
#
?
Dec 12, 2021 19:44
|
|
|
Can I claim this weekend as CPEs
|
|
#
?
Dec 13, 2021 00:09
|
|
|
Good graphic of Log4j vuln: https://twitter.com/markus_neis/status/1470109712649756674?s=20
|
|
#
?
Dec 13, 2021 01:07
|
|
|
For the people asking about Android, no, it's not affected. Android has the ability to use Java jars and bytecode for development, but it's not the JVM and doesn't feature the mechanism used for this, AIUI
|
|
#
?
Dec 13, 2021 04:58
|
|
|
Volmarias posted:For the people asking about Android, no, it's not affected. Android has the ability to use Java jars and bytecode for development, but it's not the JVM and doesn't feature the mechanism used for this, AIUI Yeah I actually scanned a couple android test devices out of curiosity, but people tend to forget: Its not REALLY java, its java-like.
|
|
#
?
Dec 13, 2021 13:40
|
|
|
https://twitter.com/p_malynin/status/1469866520939429889
|
|
#
?
Dec 13, 2021 14:36
|
|
|
|
|
#
?
Dec 13, 2021 14:44
|
|
|
Someone on a conference call around my companies response to Log4J just said they werent ever told to patch their stuff so they never have and that as a result they arent vulnerable because they run Log4J version 1x. This place is so loving backwards and behind the times. I need to remember to just take a deep breath, not let it get to me, and keep collecting the paychecks.
|
|
#
?
Dec 13, 2021 17:56
|
|
|
BaseballPCHiker posted:Someone on a conference call around my companies response to Log4J just said they werent ever told to patch their stuff so they never have and that as a result they arent vulnerable because they run Log4J version 1x. Point them to the 1.x CSV from 2 years ago that is just as bad.
|
|
#
?
Dec 13, 2021 17:59
|
|
|
|
| # ? May 25, 2024 18:22 |
|
|
Good loving lord. Now someone doesnt want to update because a change freeze was going to go into affect next week. I should just start live tweeting this poo poo. I cant believe this company hasnt been just totally annihilated by ransomware or something yet. BaseballPCHiker fucked around with this message at 18:14 on Dec 13, 2021 |
|
#
?
Dec 13, 2021 18:11
|
|