Thread by @Laughing_Mantis

#Log4J Data Exfiltration & Env Var List 🧵

I will use this thread to discuss env variables I have seen being used in the wild alongside log4j exploitation from both remote & in local subnets

This isn't a complete list but it will give you an idea what attackers are looking at

In addition to the AWS variables I have discussed earlier I am also seeing these:

For Hadoop I am seeing threat actors attempt to query the following env vars

HADOOP_HOME
HADOOP_CLIENT_OPTS
HADOOP_SHELL_EXECNAME
HADOOP_USER_PARAMS
HADOOP_SECURE_CLASSNAME
HADOOP_SECURE_USER

For postgress I am seeing several attempts:

PGPASSWORD
PGDATABASE
PGPASSFILE
PGHOST
PGSSLKEY

I think these are targeting Sauce Labs:

SAUCE_USERNAME
SAUCE_ACCESS_KEY

Seen what I think is logrhythm exploitation as well

DXPATH
DXCONFIGPATH
DXDATAPATH
DX_ES_CLUSTER_NAME

Another interesting data mining request seemed to be looking at Jupyter env vars:

JUPYTERHUB_SINGLEUSER_APP
JUPYTER_SPARK_OPTS
JUPYTER_USER_SPARK_OPTS
NOTEBOOK_EXTRA_CONF_FILE

This looks like WS02 Cloud Docker secrets from various configs:

WSO2_CLOUD_PASSWORD
WSO2_CLOUD_KEY
WSO2_CLOUD_EMAIL
WSO2_CLOUD_ORG_KEY