Critical Vulnerability In Java log4j Affecting UniFi, Apple, Minecraft, and Many Others!

Huntress Blog Post

Kevin Beaumont @GossiTheDog
John Hammond Tweet
John Hammond YouTube Channel

iPhone Tweet PoC by Cas van Cooten @chvancooten

UniFi update

Connecting With Us
---------------------------------------------------

Lawrence Systems Shirts and Swag
---------------------------------------------------

AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store

All Of Our Affiliates that help us out and can get you discounts!

Gear we use on Kit

Use OfferCode LTSERVICES to get 5% off your order at

Digital Ocean Offer Code

HostiFi UniFi Cloud Hosting Service

Protect you privacy with a VPN from Private Internet Access

Patreon

#CVE-2021-44228
#log4j
#Log4Shell

[LAWRENCESYSTEMS]

Huntress Blog Post


Kevin Beaumont @GossiTheDog
John Hammond Tweet
John Hammond YouTube Channel

iPhone Tweet PoC by Cas van Cooten @chvancooten

[sam-williams]

I've never seen your videos before, but this was a high quality video.

- It's easy to understand
- There's no annoying ads or filler
- It makes sense to technical and non technical people
- It is short.

Thank you very much.

[cidercreekranch]

Anyone doing any serious Java development uses log4j. The attach surface on the one is very very broad. I'm so glad I retired! :)

[MartesWigglesworth]

@Lawrence Systems Log4j is not for filtering logs. It is how logs are generated in java applications in general. (It is "THE" logging facility for java applications if you don't want to write your own logging out to standard output or a special tool for your application by hand. It is basically like a specific type of cabling harness which allows your speedometer to work. It is not a digital vs analog speedometer. It is HOW the speedometer works, in this metaphor.)

[officiallyRitterLost]

The kind of problems this is causing just because someone did not sanitize the input of something really shows us something: sanitize your input.

[techvortexx]

Thanks for the video, unfortuantely the situation is very bad, it is not just websites that need upgrade and edit, but as you said appliances as well, iot devices need to upgrade which is a massive and time consuming task.

[niekversteege]

Whats very annoying about fixing this is that for example, not using the library directly but having a dependency on something that is using log4j. Lots more work in testing those type of framework upgrades instead of just a logging framework.

[mathesonstep]

The deb package download link on their site (that I am using for my docker unifi controller) still has not been updated because the fix is in RC not stable yet

[tschaderdstrom]

Found 7 applications using it, but so far, none fall under the affected versions, so I guess I can have a weekend now

[julkiewitz]

Why is it even remotely possible to send a web request from within a log() call just blows my mind. In what universe is that a good idea. Java is a state of mind truly...

[wayland]

If you have your own server on the Unifi network then you have the ability to take over the device. For instance if you are a customer on a WISP network using Unifi then potentially you're already inside your own Unifi station and can launch this attack on the other stations and begin to own them.

[bren.r]

Mental Outlaw did a great video on this too. This whole thing is just laughable.

[sagarsriva]

I enjoy your videos....keep them coming!

[MrGatlin]

I'm so glad you put UniFi in the title. I was originally looking this up to fix my Minecraft stuff, but I also have a lot of UniFi gear including a UDMP.

[BufataTR]

Interesting video, good explanation. I know nothing about Java or cyber security but was thrilled anyways.

[DePromoKanaal]

Many thanks for your excellent insights on this threat. I have a unify gateway inside our network after the access router. How bad is it for us this threat?

[knightjocke]

How do you schedule updates on your controler? As an update causes a provisioning which drops clients from wifi.
Also when should you start to performance tune the controler? How many devices does the regular config handle?

[parisachilles]

It’s great that this has been found and been patched, but let’s be honest, there are gaps across the world that are either known and kept quiet amongst the hackers, or they are continually throwing hacks against servers, hoping for an opening based on known, or new entry points. Hopefully companies have good administrators keeping patches applied and are watching for hacking activities in logs.

[DriscollJeff]

Does anyone know the application being used starting at 1:50 that shows the simple flow diagram?

[anthonydefallo]

Honestly came to YouTube to see your review on this