#Log4j

[jpmellojr]

Think Log4j is a wrap? Think again

Three years after its discovery, Log4Shell remains one of the software flaws that are most used by threat actors, a new report released by Cato Networks has found. https://jpmellojr.blogspot.com/2024/08/think-log4j-is-wrap-think-again.html

[altadensidad]

6 de cada 10 empresas afectadas ¿Cómo evitar ciberataques como el Log4j?

Log4j es una de las bibliotecas de registro más populares que se utilizan en Internet, según los expertos en ciberseguridad. El pasado 9 de diciembre, se produjo una vulnerabilidad que ha afectado a casi la mitad de las compañías a nivel mundial. Imagen vía Depositphotos Los atacantes son capaces de explotar las apps vulnerables para ejecutar criptojackers y otro malware en los servidores…

[osintelligence]

https://bit.ly/45gJemi - 🏛️ The House Committee on Homeland Security has advanced five bipartisan bills aiming to enhance the nation's cybersecurity, combat the use of drones from adversaries like China, streamline DHS' approach to countering weapons of mass destruction, and support first responders. This move signals the committee's robust and bipartisan efforts to address key challenges within homeland security. #CyberSecurity #HomelandSecurity 📊 A highlight of this progression is Chairman Green's 'Securing Open Source Software Act of 2023'. The bill was introduced in response to security issues raised during the Log4j vulnerability disclosure and will address similar risks associated with other open-source software components. #SecuringOpenSource #Log4j 🌐 Chairman Green emphasized the importance of these efforts in mitigating the risk of sensitive data falling into the hands of adversarial nations, ensuring a coordinated response to threats, and managing risks associated with the use of open-source software - a crucial component of our digital ecosystem. #DataProtection #DigitalSecurity 📜 The bills passed by the Committee include: 1️⃣ H.R. 3286, 'The Securing Open Source Software Act of 2023', by Chairman Mark E. Green (R-TN) #OpenSourceAct 2️⃣ H.R. 1501, 'The Unmanned Aerial Security Act', by Rep. Michael Guest (R-MS) #UnmannedAerialAct 3️⃣ H.R. 3224, 'The Countering Weapons of Mass Destruction Extension Act of 2023', by Rep. Anthony D’Esposito (R-NY) #WMDAct 4️⃣ H.R. 3208, 'The DHS Cybersecurity On-the-Job Training Program Act', by Rep. Sheila Jackson Lee (D-TX) #CyberTrainingAct 5️⃣ H.R. 3254, 'The First Responder Access to Innovative Technologies Act', by Rep. Donald Payne (D-NJ) #FirstResponderAct These advancements affirm the Committee's commitment to strategically addressing pressing issues facing homeland security.

[edwardos]

I think the verdict is now very clear about when the Minecraft Silver Age ended.

[english-mace]

linux is not. magically free of the Dependencies curse, tho.

like I respect the moxie & mod-ability of an open OS as much as the next bigtech girlie but it very much is still Computer

it's honestly nuts to me that critical infrastructure literally everywhere went down because everyone is dependent on windows and instead of questioning whether we should be letting one single company handle literally the vast majority of global technological infrastructure, we're pointing and laughing at a subcontracted company for pushing a bad update and potentially ruining themselves

like yall linux has been here for decades. it's stable. the bank I used to work for is having zero outage on their critical systems because they had the foresight to migrate away from windows-only infrastructure years ago whereas some other institutions literally cannot process debit card transactions right now.

global windows dependence is a massive risk and this WILL happen again if something isn't done to address it. one company should not be able to brick our global infrastructure.

[cyber-sec]

Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild

Source: https://blog.talosintelligence.com/apache-log4j-rce-vulnerability/

[jadeghosthill]

2b2t players will post videos about "Minecraft's most DANGEROUS bug" and it's actually just a really niche glitch that lets you find someone's base and the only reason its dangerous is because 2b2t players are mentally ill

good for them but log4j existed there are more dangerous bugs i think

[aktionfsa-blog-blog]

Gesundheitsdaten nur bedingt sicher

KIM = Kaos in der Medizin

Eigentlich sollte KIM ein sicherer E-Mail Service für die Medizin, also die Kommunikation zwischen Krankenkassen und Ärzten sein. Etwas ähnliches gibt es auch seit Jahren im Bereich der Justiz für Gerichte und Anwälte. Insofern handelt es sich nicht um die grandiosiste Innovation. 

Trotzem ging es schief. Wie auf dem 37. CCC Kongress in Hamburg von dem Münsteraner Sicherheitsforscher Christoph Saatjohann vom Fraunhofer-Institut für Sichere Informationstechnologie (SIT) in Münster und Sebastian Schinzel berichtet wurde, haben insgesamt acht Krankenkassen durch die Gematik den gleichen S/MIME-Key erhalten. Sichere E-Mail beruht auf dem seit den 80-iger Jahren von Phil Zimmermann entwickelten Public-Private-Key Verfahren. In öffentlichen Einrichtungen geschieht das nach dem Standard X.509, während im privaten Umfeld Jede/r seine Schlüsselpaare selbst generieren kann.

Wenn jedoch die Zertifizierungsstellen (CAs) für verschiedene Akteure die gleichen Schlüssel verteilen, dann war es das mit der Sicherheit sensibler medizinischer Daten. Das ist der GAU in der PKI - der Public Key Infrastructure.

Laut den Sicherheitsforschern hatten, wie Heise.de schreibt, einmal drei Krankenkassen denselben im September 2021 ausgestellten Schlüssel, bei einem zweiten Schlüssel fünf. 28% der Bürgerinnen und Bürger seien über diese acht Krankenkassen versichert gewesen. Dieser Vorfall war nicht der erste mit KIM. 2022 wurde eine Log4J-Schwachstelle im KIM-Clientmodul von T-Systems gefunden.

Künftig werden die Schlüssel nun monatlich auf Dopplungen geprüft.

Mehr dazu bei https://www.heise.de/news/37C3-Schluessel-fuer-E-Mail-Dienst-KIM-fuer-das-Medizinwesen-mehrfach-vergeben-9583275.html

Kategorie[21]: Unsere Themen in der Presse Short-Link dieser Seite: a-fsa.de/d/3y7 Link zu dieser Seite: https://www.aktion-freiheitstattangst.org/de/articles/8633-20231229-gesundheitsdaten-nur-bedingt-sicher.html

[queerbogbitch]

botnets like mirai are pretty prolific, people just don't notice because nobody cares about securing routers and IoT

the modern internet needs a new mega virus. weve gone too long without having a named virus that takes out a major % of computers

[tap-tap-tap-im-in]

I just manually updated a component inside a minecraft modpack so that it no longer had the log4j vulnerability and could be run safely.

And I have to say, that was ridiculous, I could never have done that a few years ago.

Granted, part of the complexity is that I run my servers via a user that has no password, no sudo access, and no real access to the system except the servers and their related files, as I should.

But blech.

[jpmellojr]

Cloudflare report: Log4j remains top target for attacks in 2023

Log4j remained a top attack vector for threat actors in 2023, while a new vulnerability, HTTP/2 Rapid Reset is emerging as a significant threat to organizations, according to Cloudflare’s annual “Year in Review” report. https://jpmellojr.blogspot.com/2023/12/cloudflare-report-log4j-remains-top.html

[educarecentre]

The Role of Log Frameworks in Academic Research and Data Management

In academic research, maintaining structured and well-documented data is essential for ensuring transparency, reproducibility, and efficient analysis. Just as log frameworks play a critical role in software development by tracking system behavior and debugging errors, they also serve as valuable tools for researcher’s handling large datasets, computational models, and digital experiments.

This article explores the significance of log frameworks in research, their key features, and how scholars can leverage structured logging for efficient data management and compliance.

What Is a Log Framework?

A log framework is a structured system that allows users to generate, format, store, and manage log messages. In the context of academic research, logging frameworks assist in tracking data processing workflows, computational errors, and analytical operations, ensuring that research findings remain traceable and reproducible.

Researchers working on quantitative studies, data analytics, and machine learning can benefit from logging frameworks by maintaining structured logs of their methodologies, similar to how software developers debug applications.

For further insights into structuring academic research and improving data management, scholars can explore academic writing resources that provide guidance on research documentation.

Key Features of Log Frameworks in Research

🔹 Log Level Categorization – Helps classify research data into different levels of significance (e.g., raw data logs, processing logs, and result logs). 🔹 Multiple Storage Options – Logs can be stored in databases, spreadsheets, or cloud-based repositories. 🔹 Automated Logging – Reduces manual errors by tracking computational steps in the background. 🔹 Structured Formatting – Ensures research documentation remains clear and reproducible. 🔹 Data Integrity & Compliance – Supports adherence to research integrity standards and institutional requirements.

For a more in-depth discussion on structured academic documentation, scholars can engage in free academic Q&A discussions to refine their research methodologies.

Why Are Log Frameworks Important in Academic Research?

1️⃣ Enhanced Research Reproducibility

Logging helps ensure that all data transformations, computational steps, and methodological adjustments are well-documented, allowing other researchers to replicate findings.

2️⃣ Efficient Data Monitoring & Debugging

Researchers working with complex datasets or computational tools can use log frameworks to track anomalies and discrepancies, much like software developers debug errors in applications.

3️⃣ Compliance with Ethical & Institutional Guidelines

Academic institutions and publishers require transparency in data collection and analysis. Proper logging ensures compliance with ethical standards, grant requirements, and institutional policies.

4️⃣ Long-Term Data Preservation

Structured logs help retain critical research details over time, making it easier to revisit methodologies for future studies.

To explore additional academic research tools and methodologies, scholars may access comprehensive digital libraries that provide authoritative research materials.

Popular Log Frameworks for Research & Data Analysis

Log4j (Java) 📌 Use Case: Computational modeling, simulation research 📌 Pros: Highly configurable, supports integration with data analysis platforms 📌 Cons: Requires security updates to prevent vulnerabilities

Serilog (.NET) 📌 Use Case: Quantitative research using .NET-based statistical tools 📌 Pros: Supports structured logging and integration with visualization tools 📌 Cons: Requires familiarity with .NET framework

Winston (Node.js) 📌 Use Case: Web-based academic data analysis platforms 📌 Pros: Supports real-time research data logging and cloud integration 📌 Cons: May require additional configuration for large-scale data processing

ELK Stack (Elasticsearch, Logstash, Kibana) 📌 Use Case: Large-scale academic data aggregation and visualization 📌 Pros: Allows powerful search capabilities and real-time monitoring 📌 Cons: Requires technical expertise for setup and configuration

How to Choose the Right Log Framework for Academic Research

When selecting a log framework for research purposes, consider:

✅ Compatibility with Research Tools – Ensure it integrates with statistical or data management software. ✅ Scalability – Can it handle large datasets over time? ✅ User Accessibility – Does it require advanced programming knowledge? ✅ Data Security & Ethics Compliance – Does it meet institutional and publication standards?

Conclusion

Log frameworks are invaluable for researchers handling data-intensive studies, ensuring transparency, reproducibility, and compliance. Whether used for debugging computational errors, tracking methodological changes, or preserving data integrity, structured logging is a critical component of academic research.

For further guidance on structuring research documents, scholars can explore academic writing resources and engage in peer discussions to enhance their methodologies. Additionally, accessing digital academic libraries can provide further insights into data-driven research.

By incorporating effective log frameworks, researchers can elevate the quality and reliability of their academic contributions, ensuring their work remains impactful and reproducible.

[threetrenchcoatsinatrenchcoat]

on the one hand it's kinda annoying that our digital and physical lives are coated with ads set on making us feel incomplete, for companies that then have unchecked censorship rights on their surrounding content, and political campaigns are won by the most advertised candidate, and the surveillance state created by the amount of our data being sold is used for voter suppression and stalkers, and it's burning down the planet with direct online advertising alone producing the equivalent of up to 159 metric tons of carbon dioxide emissions a year,

but hey, the internet couldn't possibly ever be run by volunteers.

except it is. right now.

XZ Utils and OpenSSL and Log4j and many projects like them are volunteer-led--OpenSSL in particular is almost entirely managed by two men named Steve. the projects have some funding sometimes but the people who fix stuff when it breaks usually aren't paid and all have other full-time jobs. we know this because it's happened, i only heard about these specific services because they've all recently had vulnerabilities that had to wait for volunteers to get off work or for one of the Steves to pause his vacation. and some big companies were relying on them.

big companies like linux and facebook and google and microsoft and amazon web services and twitter and cloudflare and apple and intuit and paypal and tumblr. y'know, basically the internet. so much of their infrastructure is volunteer code right now. if they don't need all that ad money and user data we're netting them, what are we actually getting in return?

what if we just turned the ads off? what if we just turned the ads off? what if we just turned the ads off?

what if the next time google wants to collect data to sell for drone strikes they have to fill out a grant proposal and put the notion on a ballot?

love when ppl defend the aggressive monetization of the internet with "what, do you just expect it to be free and them not make a profit???" like. yeah that would be really nice actually i would love that:)! thanks for asking

[digitalworldvision]

Summary of Cybersecurity Alert: Hackers Exploit Logging Errors!

Importance of Logs: Logs are essential for monitoring, maintaining, and troubleshooting IT systems. However, mismanaged or poorly configured logs can expose vulnerabilities to attackers.

Exploitation by Hackers: Cybercriminals target logging systems to inject malicious code, gain unauthorised access, or steal data. Examples include the Log4Shell vulnerability in the Log4j library.

Consequences of Compromised Logs: A compromised logging system can lead to data breaches, business disruptions, financial losses, regulatory fines, and damaged stakeholder trust.

Securing Logging Systems: Businesses should upgrade to advanced log management tools that provide real-time monitoring, anomaly detection, and centralised secure log storage.

Zero Trust Security Model: Adopting a zero trust approach combined with smart logging practices prevents attackers from freely moving within compromised systems and helps detect malicious activities.

Common Hacker Techniques:

Log Deletion: Attackers delete logs to erase evidence, as seen in the 2017 Equifax breach.

Log Alteration: Hackers modify or forge logs to mislead investigators, as in the 2018 SingHealth breach.

Disabling Logs: Disabling logging services to avoid detection, as in the 2020 SolarWinds attack.

Encrypting Logs: Attackers encrypt logs to prevent analysis, as in the NotPetya ransomware attack.

Changing Retention Policies: Altering log retention settings to ensure evidence is purged before investigation, as seen in the 2018 Marriott breach.

Historical Examples: Real-world breaches like Equifax (2017), SingHealth (2018), SolarWinds (2020), and NotPetya (2017) demonstrate the devastating impact of log manipulation.

Protecting Logs:

Store logs securely.

Restrict access to authorised personnel.

Mask sensitive information in logs.

Error Logs as Targets: Hackers analyse error logs to find vulnerabilities and misconfigurations, crafting precise attacks to exploit these weaknesses.

Business Risk Management: Protecting logging systems is not just an IT issue—it’s a critical part of business risk management to prevent dangers.

The Log4Shell Vulnerability

In late 2021, a critical vulnerability known as Log4Shell (CVE-2021-44228) was discovered in Apache Log4j 2, a widely used Java logging library. This vulnerability allowed attackers to execute arbitrary code on affected systems by exploiting how logs were processed. The flaw was particularly dangerous because it was easy to exploit and affected a vast number of applications and services globally.

1. financial losses and safeguard company reputation.

Consequences of Compromised Logging Systems

When attackers exploit vulnerabilities in logging systems, the repercussions can be severe:

Data Breaches: Unauthorised access to sensitive information can lead to data theft and privacy violations.

Business Interruptions: System compromises can cause operational disruptions, affecting service availability and productivity.

Financial Losses: The costs associated with remediation, legal penalties, and loss of business can be substantial.

Reputational Damage: Loss of stakeholder trust and potential regulatory fines can harm a company's reputation and customer relationships.

Real-World Examples of Log Manipulation

Several high-profile incidents illustrate the impact of log manipulation:

Equifax Breach (2017): Attackers exploited a vulnerability in the Apache Struts framework and manipulated system logs to cover their activities.

SingHealth Breach (2018): Attackers used advanced techniques to hide their presence by altering log entries, delaying detection.

SolarWinds Attack (2020): Attackers disabled logging mechanisms and monitoring systems to avoid detection during their intrusion.

NotPetya Ransomware (2017): Attackers encrypted key system files, including logs, to hamper recovery efforts and obscure their actions.

Protecting logging systems is not merely a technical concern but a critical aspect of comprehensive business risk management. By understanding the risks associated with logging vulnerabilities and implementing robust security strategies, organisations can defend against these hidden dangers and safeguard their operations.

[learning-code-ficusoft]

Top 10 Java Libraries and Frameworks Every Developer Should Know

Top 10 Java Libraries and Frameworks Every Developer Should Know 

 1. Spring Framework 

Comprehensive ecosystem for enterprise Java development — Dependency injection — MVC architecture — Microservices support 

 2. Hibernate 

Object-relational mapping (ORM) library — Simplifies database interactions — Supports multiple databases — Reduces boilerplate database code 

 3. Apache Maven 

 Project management and build automation tool — Dependency management — Standardized project structure — Easy integration with CI/CD pipelines 

 4. JUnit

 — 

Unit testing framework — Supports test-driven development — Annotations for test configuration — Wide IDE integration

5. Apache Spark — Big data processing framework — Distributed computing — Machine learning capabilities — Real-time data streaming 

 6. Mockito — Mocking framework for unit tests — Allows creation of test doubles — Verifies method interactions — Simplifies complex testing scenarios 

 7. Lombok — Reduces boilerplate code — Automatic getter/setter generation — @Data, @Builder annotations — Improves code readability 

 8. Jackson — JSON processing library — Object serialization/deserialization — High-performance JSON parsing — Supports complex object mappings 

9. Log4j — Logging framework — Configurable logging levels — Performance optimization — Multiple output destinations 

10. Guava — Google’s core libraries — Utility classes — Functional programming support — Improved collections and caching

WEBSITE: https://www.ficusoft.in/core-java-training-in-chennai/

[koronkowy]

Summary

🌐 Introduction to Internet Background Exploitation:

Andrew Morris explains the growing challenges of internet-wide vulnerability exploitation and the concept of "internet background noise," which includes mass scanning and exploitation attempts.

🔍 Key Trends and Challenges:

Mass Exploitation:

Attackers focus on vulnerabilities first, scanning the entire internet for potential targets, rather than targeting specific organizations.

Tools like ZMap and Masscan have made internet scanning faster and more efficient, enabling attackers to find vulnerable systems within minutes.

Proliferation of Noise:

Background noise on the internet arises from both legitimate and malicious activities, complicating the identification of threats.

🔧 Strategies and Tools:

GreyNoise:

Deploys a distributed sensor network to detect and analyze mass exploitation attempts.

Creates signatures for exploitation patterns and provides temporary blocklists to protect vulnerable systems.

Case Studies:

Examples like Log4j and other vulnerabilities show how quickly attackers exploit disclosed vulnerabilities, often within hours.

🎯 Future Outlook:

Emphasis on proactive defense strategies like whack-a-mole-style blocking of malicious IPs.

The importance of global collaboration and data sharing to mitigate internet-wide threats effectively.