Hacker News Reader

Comment by ronnier | Hacker News Reader

Are there any notable systems exploited by this besides minecraft?

you could probably fire a bullet in any direction and hit a company with hundreds of apps or appliances affected.

I recognize this probably isn't helpful on its face, but the best way to think of it is: if it's a Java app (or heck even possibly just an app running on the JVM) that uses the most recent major version (2.x before 2.15.0, the patch) of the most common logging logic, it's affected.

And that list in the enterprise space gets exceptionally long. Maybe not so much on client machines, but servers/etc absolutely.

Even companies not known for using Java for their own apps are probably relying on appliances or systems which run their own vulnerable Java apps.

There's also a tendency for a lot of Cybersecurity type software to use java and log4j. Things like SAML, SSO, code scanning, etc. I'm fighting a bit of schadenfreude watching all of those vendors furiously trying to get their stories together.

Many, many of them. See the gist posted in another comment: https://news.ycombinator.com/item?id=29543439

Though even that long list is missing many. I have lots of emails in my inbox from various software vendors that are NOT listed in that Gist.

It's probably easier to compile a list of software you use that uses java, then the short of those projects that DON'T use log4j.

Kronos private cloud. Wouldn't be surprised to see disruption to UKG.

https://community.kronos.com/s/feed/0D54M00004wJCdJSAW?langu...

https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970...

It's still very early, we won't have breach notifications for a while since any attacks would have started in the last few weeks at the earliest, and most would have started last week.

It’s possible that it was exploited before the issue was widely discovered, right? I thought it had been in there for a while.

IIRC Cloudflare said the earliest they had seen this being exploited in the wild was very early December, but the volume went up after Friday.

It's entirely possible and it's still so early that we're still guessing. But so far some companies have come out to say that they've seen exploitation only as early as a few weeks ago.

Companies likely only started IR in the last week. Breach notifications, which only a minority of companies will bother to send out, will be a few weeks away at the earliest.

My ERP, PLM and MRO vendors are all still investigating.....

I suspect we'll be patching quickly before Christmas.

Unifi systems is a pretty bad one

UBNT says the Unifi Network app is unaffected, but they are patching "out of an abundance of caution"... whatever that means.

Reply on news.ycombinator.com