#Log4J Worm is ITW

@vxunderground has a sample of the self propagating worm using log4j as a vector.

It installs a Mirai bot which makes sense to targeting embedded Linux devices

Looks like it uses user-agent for exploitation and modifies the binary before sending (?)
From what I can quickly reverse engineer it looks like this malware is targeting mainly Huawei routers

Very very similar to CVE-2017-17215

For reference:

securitynews.sonicwall.com/xmlpost/new-wa…
This variant will quickly get modified and used and repurposed to exploit other hardware and devices.

Welcome to the age of the log4j worms everyone.

🪵🪱
Impact of this worm is unknown, I have no idea how many devices this will compromise but it could set up quite a large botnet for launching DDoS and other services in order to gain money.

My guess: Expect DDoS attempts to escalate around Xmas

Expect other variants soon
As someone who used to be a VXer and wrote several worms in early 2000s there is some developmental time frames for these pieces of malware.

- Research propagation method
- Add it to base viral code
- Test in a limited environment
- Rewrite and retest
- release into wild later
The time for release is never immediately after development

Releasing into the wild requires window of opportunity, removal of evidence of meta data and author, destroying hardware that created it on, and deploying it in a fashion that can't be traced back to you.
Huge shout out to @1ZRR4H who discovered this in the wild and posted it to @vxunderground who continue to be the best source for malware research on the internet bar none.

Also if possible please make sure you donate, subscribe, and give samples to VXU to support their services
And finally CC: @vmyths

My timing was aggressive, but time between development and deploy and discovery was imho pretty close

All the features I mentioned in the original post appear to be lined up in this as well.

Future variants on the way

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Greg Linares

Greg Linares Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Laughing_Mantis

19 Dec
This is a reminder to ask my friends here, please take Omicron seriously.

As someone who has dealt with having chronic illness for years that are nearly identical to long COVID symptoms; it is really really hard

Quality of life is something you don't appreciate until it's lower
I have #fibromyalgia and some days I can't physically get out of bed, and that's because of pain, or fatigue.

My pain comes in 2 types:
Phantom Sunburn
Torture Compression

The 1st feels identical to like an Arizona sunburn, except no skin color and putting on aloe doesn't help
The crushing feels like having rubber bands on your limbs that keeps getting tighter and tighter and you can't take them off.

Sometimes I imagine a steamroller crushing my legs is how it feels.

And these are not my worse symptoms

The fatigue is what kills me.
Read 8 tweets
13 Dec
#log4j theoretical worm depending on propegation speed might just blend in with the noise for a while.

Ideally right now reducing attack surface should be everyone's top priority

Unfortunately we are dealing with a bug with unprecedented vectors.
Everyone right now shouldn't even focus on worm capabilities because exploitation is so wide spread right now it doesn't even increase your risk level, attackers are doing nearly identical to what worm activity would be like.

Traffic congestion and network bottlenecking tho...
Historically if we look at worm activity it took roughly a week to 14 days for them to be widespread & developed

However those in the past didn't use logic flaws & required memory corruption exploits which are less reliable & complex payloads.

This is much lower skill ceiling
Read 5 tweets
12 Dec
#Log4J based on what I've seen, there is evidence that a worm will be developed for this in the next 24 to 48 hours.

Self propagating with the ability to stand up a self hosted server on compromised endpoints.

In addition to spraying traffic, dropping files, it will have c2c
Biggest hurdle appears to be implementing a JDK gadget to enable code execution on limited env.

That is currently being researched by several groups.
Honestly I'm kinda surprised it isn't finished yet, but I have seen at least 3 groups (Eastern euro, .ru and .cn) that are investigating options to do this.

Goals appear varied: financial gain via extortion as well as selling access to compromised hosts to RaaS groups
Read 7 tweets
12 Dec
#Log4J Data Exfiltration & Env Var List 🧵

I will use this thread to discuss env variables I have seen being used in the wild alongside log4j exploitation from both remote & in local subnets

This isn't a complete list but it will give you an idea what attackers are looking at
In addition to the AWS variables I have discussed earlier I am also seeing these:

For Hadoop I am seeing threat actors attempt to query the following env vars

HADOOP_HOME
HADOOP_CLIENT_OPTS
HADOOP_SHELL_EXECNAME
HADOOP_USER_PARAMS
HADOOP_SECURE_CLASSNAME
HADOOP_SECURE_USER
For postgress I am seeing several attempts:

PGPASSWORD
PGDATABASE
PGPASSFILE
PGHOST
PGSSLKEY
Read 6 tweets
11 Dec
PSA: attackers aren't just using #log4j attacks on internet facing devices.

Groups I'm monitoring are going back to compromised networks and using it on subnets and on internal devices *very* successfully

Insider threat is also an viable avenue of exploitation
Update: here's what vectors internal threat actors are using to gain access via #log4j exploits:

Email/inbox monitoring services
Network inspectors
Internal web servers
SSL inspectors
Couchdb(?) Logging services
Asset management services
XML parsing services
Email: sending log4j in subjects to null addresses or internal

Network: spamming STUN, ARP, UDP, and MDNS traffic with log4j in packets

SSL: setting up malicious SSL servers and waiting for connections

Dropping log4j in xml files that are being referenced or ingested
Read 4 tweets
11 Dec
To add on to what @dildog is referencing with AWS vars and log4j

Here is a list of the AWS envs that I've seen attackers attempt to dump from the target machine

docs.aws.amazon.com/cli/latest/use…
So when you see the "You just got RCE and you use it to info dump" people, please kindly remind them that RCE isn't always as fancy as they would love to think
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(