#log4j theoretical worm depending on propegation speed might just blend in with the noise for a while.
Ideally right now reducing attack surface should be everyone's top priority
Unfortunately we are dealing with a bug with unprecedented vectors.
Ideally right now reducing attack surface should be everyone's top priority
Unfortunately we are dealing with a bug with unprecedented vectors.
Everyone right now shouldn't even focus on worm capabilities because exploitation is so wide spread right now it doesn't even increase your risk level, attackers are doing nearly identical to what worm activity would be like.
Traffic congestion and network bottlenecking tho...
Traffic congestion and network bottlenecking tho...
Historically if we look at worm activity it took roughly a week to 14 days for them to be widespread & developed
However those in the past didn't use logic flaws & required memory corruption exploits which are less reliable & complex payloads.
This is much lower skill ceiling
However those in the past didn't use logic flaws & required memory corruption exploits which are less reliable & complex payloads.
This is much lower skill ceiling
The wild card here is the JDK gadget. If it is possible that would be *really* interesting.
That would allow exploition in env that RCE would normally not be allowed.
This is the real microcosm arms race that is going on right now.
That would allow exploition in env that RCE would normally not be allowed.
This is the real microcosm arms race that is going on right now.
Will the developers release without the JDK gadget? That's the question, lose potential target access in order to improve payload delivery is a gamble.
That's is a gamble that if I was an attacker I wouldn't take
I would release version 1, and release gadget version with 2.
That's is a gamble that if I was an attacker I wouldn't take
I would release version 1, and release gadget version with 2.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
