Importance of Attack Surfaces in Log4shell Context

 Introduction

Everyone in the IT Industry is alarmed by the discovery of a 0-day vulnerability in the famous Log4j, java logging framework. It's been assigned with a CVSS score of 10, which means any application using a vulnerable version of Log4j can be exploited by anyone. Such is the the severity of this vulnerability. It's imperative to fix this vulnerability and there are various threads out there on how to fix this issue and there are different third-party tools to find the usage of vulnerable log4j jars. This blog will not talk about this and is talking about the importance of keeping track of your IT Assets to stay resilient when attacks of such scale emerge in the future. 

Know Your Attack Surface

Attack Surface - Different Points in the IT landscape of an organization, through which an attacker can attack your IT Infrastructure. 

With the increase in the IT complexity and the presence in the IT Landscape, the Attack surface of any organization is growing day by day. It's is very important to keep track of this growing IT resources,  failing to do so will lead to Shadow IT Resources. The Shadow IT Resources are one of the easiest ways in which an attacker can gain access to your organizations. 

What are Shadow IT Resources?

With the increase in IT infrastructure of the organizations, some of the resources may get orphaned or may not be under the radar of the IT operations team. Those resources, which gets orphaned by the IT Teams but are inside the organization's IT infrastructure are called Shadow IT Resources. It is important to know all your IT resources and Attack Surfaces. 

 What's the relevance with Log4Shell

Log4shell is a common vulnerability and many IT components are vulnerable to this attack. The patching process and the fixed jar are released immediately, but it's the organization responsibility to identify and apply the necessary patch for on the vulnerable components. 

This where "Know Your Resources" is critical. It is not possible to patch a resource which is unknown to an organization. Shadow Resources can be discovered and attacked by Hackers. It's important to discover those Shadow Resources and terminate them properly. 

For example, a legacy application or a device which is using  the vulnerable version of log4j and is not known to the organization, can be identified and exploited by Hackers. The level of complexity in performing the exploit is also very low and hence attackers with very limited technical skill can also attack your organization and your business can go for a toss. 

Conclusion

Speed up your IT team to discover and keep an update list of the IT resources, Applications, components that are used by employees, third-party, your applications, etc. Regularly audit the resources and check for vulnerable components, unused IT resources, deprecated software, and remove them. This is critical to organizations of any size. The only way to weather the vulnerabilities like log4shell is to keep your IT resources in check and immediately patch them. Otherwise the business will go for a toss and attackers can ruin the reputation of your business. Stay secure.

Comments

Post a Comment

Popular posts from this blog

Security Score Card using Nuclei Automation

Image
  Introduction Nuclei by Project Discovery is a great tool for automation, and I've started using the tool for automated scanning of vulnerabilities and for automated regression testing. I find it very useful in adding customized templates and get accurate results. Now for a complete automation, I've written python wrapper around my nuclei test cases and added the python script to the crontab. It may not be possible to automate 0-days, but once it is a 1-day, you should have an automation to check for the vulnerability, else someone else will find it. The Idea of Score Card: Everything works great, and my target is a fixed set of around 600 servers. I had an idea to build an executive level dashboard, that can calculate a score based on the results of the automation. So, I started to build a score-card using Site24x7,  The Logic: The logic is a weighted sum of the categories of issues found.  For example in a given scenario, Severity Score High 60  Medium 30  Low 10  The formul
Read more

Extracting Dynamic Values from Multiple Requests in a Nuclei Template

Introduction We are using Nuclei for all the Security Automation tasks. We create a lot of custom templates to automate custom Authenticated APIs. A major challenge that we faced in automating this is dependence on dynamic variables. Site24x7's APIs have various dynamic entities that are dependent on other APIs for data. You can find Site24x7 Rest API reference.  Problem Statement Let's take this example for this blog. To automate monitor addition in Site24x7, we need to call a POST API "https://www.site24x7.com/api/monitors" with some body content. But, the problem is body content has so many dependencies which are dependent on other APIs. For example to call the above api, we need threshold_profile, notification_profile, user_group_id. So, to get these three values, we have to call the three apis sequentially extract the ids and pass it on to the Monitor Addition API. Nuclei Extractors https://nuclei.projectdiscovery.io/templating-guide/operators/extractors/ To ac
Read more

How I used Nuclei to Automate Basic Security Checks

 Nuclei by Project Discovery Nuclei is an automation tool built by Project Discovery. The tool is open source and has various CVE Templates bundled with it. Also, the templates are updated on a regular basis. You can also create a customized template for your needs.    Why I chose Nuclei as a DAST tool? I've been doing Product Security Testing for one of my targets. We have found various categories of bugs manually, and considering the fact that the product is a growing one and the same bug may pop-out again, we have decided to automate the security cases that we have found earlier. The tools that I considered are Burp, ZAP automation, and later I got to know about Nuclei.  I'm using the free version of Burp and it doesn't support automation, otherwise an excellent tool. ZAP is an open source tool, and it has so many options available but I feel it to be little complicated and find it difficult to use on a regular basis.  On surfing Twitter and YouTube, I got to know about
Read more