1/ #Log4Shell Status determination
# Block Rules / Log-Based Detection
There's no effective or rather gapless way to detect attacks that use log4shell due to the many ways to obfuscate the strings.
Don't put too much trust in any filter/detection pattern. All can be bypassed.
..
# Block Rules / Log-Based Detection
There's no effective or rather gapless way to detect attacks that use log4shell due to the many ways to obfuscate the strings.
Don't put too much trust in any filter/detection pattern. All can be bypassed.
..
2/ # Behaviour Based Detection
We thought about network based detection, but it could be any remote port and any remote system. Java can have many legitimate outgoing connections & often has suspicious sub processes.
We thought about network based detection, but it could be any remote port and any remote system. Java can have many legitimate outgoing connections & often has suspicious sub processes.
3/ # Vulnerability Detection
It's difficult to find vulnerable software. It could be the web app, the ticket mgmt that receives contact form content or the backup software. Vuln scanners won't give a complete picture.
Discovery could take months.
Try to use the Canary Tokens.
It's difficult to find vulnerable software. It could be the web app, the ticket mgmt that receives contact form content or the backup software. Vuln scanners won't give a complete picture.
Discovery could take months.
Try to use the Canary Tokens.
4/ # Patching
Since it's difficult to determine the vulnerable applications, it'll be difficult to patch what you don't know.
Since it's difficult to determine the vulnerable applications, it'll be difficult to patch what you don't know.
5/ # Post-Exploitation / Compromise Assessments
My best hope is that we can find enough evidence after a successful exploitation. Attackers have goals and try to persist their access on a compromised systems. Current tools and frameworks should help us with that.
My best hope is that we can find enough evidence after a successful exploitation. Attackers have goals and try to persist their access on a compromised systems. Current tools and frameworks should help us with that.
6/ # Final thoughts
I hope that we can at least filter and detect the simple attempts and prevent some damage.
I wish you all the best in the coming months.
I hope that we can at least filter and detect the simple attempts and prevent some damage.
I wish you all the best in the coming months.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
