Log4jAttackSurface VS canarytokens

Checkout this link for knowing Log4j impact on manufacturers https://github.com/YfryTchsGD/Log4jAttackSurface

Just look at the currently ongoing insanity that is the log4j exploit, and how one single exploit has lead to a generic attack that can impact tons of companies. Imagine if a state decided to use voting machines, and someone found this style of exploit in the system.

Last week (Dec 9th) a major vulnerability was discovered in an open source logging project for Java called log4j. The vulnerability called Log4Shell would allow anyone to remotely run arbitrary code if they sent a message in the right format to the server. This is one of the worst attacks your system can be susceptible to and if you are interested in the technical details of the problem, here is an overview. The attack surface of Log4Shell is staggering, Amazon, Apple, Google, and the Apache Server are affected; it can almost not get bigger than this. We will see the real fallout of Log4Shell in the next weeks and months as right now servers worldwide are being scanned and prodded for this vulnerability.

Companies should verify they are not running any exposed Log4j Java code.  Here is a list of impacted 3rd party software for your reference.  If you find a server at risk, there are three potential ways to fix it as follows.

Looking for vendors/software on known lists like https://github.com/YfryTchsGD/Log4jAttackSurface

Blender ist nicht betroffen, #42

It does and was also affected by log4j.

Thanks, sure it isn't complete but it does contain some scary and surprising (at least when first reading, of course the really aren't) things like: https://github.com/YfryTchsGD/Log4jAttackSurface/blob/master/pages/UniFi.md

Apparently there's proof Steam along with many others are vulnerable.

Get a free OS in a VMand open any files in there. You should not trust a random batch of potentially backdoored or canarytoken'ed files

Throw some honeytokens/canarytokens on key systems. Thinkst has a free option where you can drop Word docs, PDF, AWS keys, etc. that will send you an email or webhook if they're ever used. https://canarytokens.org

QR code with some pdfs from inside a canarytokens.org folder.

You can generate Canarytokens for free on their website: https://www.canarytokens.org/generate. They're open-source, so if you're technically-inclined, you can run the software yourself: https://github.com/thinkst/canarytokens. All the documentation is here: https://docs.canarytokens.org/guide/.

I do not think a trap or "phishing link" is a good idea if she are getting serious threats! But it is not too hard, you can generate a few with here and if somebody opens the link you will get an email containing the time and IP address of who opened it: https://canarytokens.org (note that, you can not really do much with these information on your own).

Good tip, OP could use this for quick setup. https://canarytokens.org