Researchers trigger new exploit by renaming an iPhone and a Tesla | The Verge

Security researchers investigating the recently discovered and “extremely bad” Log4Shell exploit claim to have used it on devices as varied as iPhones and Tesla cars. Per screenshots shared online, changing the device name of an iPhone or Tesla to a special exploit string was enough to trigger a ping from Apple or Tesla servers, indicating that the server at the other end was vulnerable to Log4Shell.

#technology #tech #security #privacy #hacking #malware #phishing #Log4Shell #log4j

https://www.theverge.com/2021/12/13/22832552/iphone-tesla-sms-log4shell-log4j-exploit-researchers-test

Researchers trigger new exploit by renaming an iPhone and a Tesla

The exploit is all the more dangerous for being easy to use.

Oh man that’s so very bad. I feel for all the people affected by this.

https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/

#log4shell

As Log4Shell wreaks havoc, payroll service reports ransomware attack

Kronos outage will last several weeks. Firm advises customers to use other services.

Tag Nummer 3 mit #log4shell ist rum. Langsam sehen wir Licht.
Was für eine Bitch!

#security

Log4Shell : derrière l'importante faille, l'éternelle question du soutien au logiciel libre

https://www.nextinpact.com/article/49180/log4shell-derriere-importante-faille-eternelle-question-soutien-au-logiciel-libre

#Log4Shell #Log4j #LogicielLibre

Log4Shell : derrière l'importante faille, l'éternelle question du soutien au logiciel libre

A nice end-user summary of the #log4shell #security vulnerability. (Diaspora doesn’t happen to be vulnerable as it doesn’t use the afflicted software.) It’s another reason to use #zerotrust security policies, and to containerize your applications.

https://arstechnica.com/information-technology/2021/12/the-log4shell-zeroday-4-days-on-what-is-it-and-how-bad-is-it-really/

The Log4Shell 0-day, four days on: What is it, and how bad is it really?

If max-severity 0-day hasn't already dampened your Xmas spirit, it likely soon will.

Some indicators of compromise for the #Log4Shell #log4j vulnerability: https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/

NCSC-NL has compiled an incomplete list of products that could be affected by the #Log4Shell #log4j vulnerability and known vulnerability/fix/workaround status.

log4shell/software at main · NCSC-NL/log4shell

Operational information regarding the vulnerability in the Log4j logging library. - log4shell/software at main · NCSC-NL/log4shell

Das wird auch morgen früh in meiner Behörde nicht anders sein.

https://twitter.com/Stadt_Wiesbaden/status/1470046808122535946
#log4j #log4shell

Popcornhol...

https://www.golem.de/news/log4shell-bsi-vergibt-hoechste-warnstufe-fuer-log4j-luecke-2112-161734.html
#log4j #log4shell

Log4Shell: BSI vergibt höchste Warnstufe für Log4J-Lücke - Golem.de

Das Ausmaß der Log4J-Lücke ist laut BSI derzeit noch nicht absehbar. Und der Log4J-Maintainer wird für die Arbeit offenbar nicht bezahlt.

Log4j is broken when unfixed. However log4shell can be fun ..

https://twitter.com/gegy1000/status/1469714451716882434

#security #log4j #log4shell

#log4j #log4shell

♲ Matthias Schmidt - 2021-12-11 19:28:38 GMT

This XKCD is still true: https://xkcd.com/2347/

#log4j

Bingo - bin mit mindestens einem System dabei. Ick freu mir.

#security

♲ HonkHase - 2021-12-11 08:39:48 GMT

Schnelltest von #log4j auf die #Log4Shell Schwachstelle

Testet bitte alle eure Anwendungen!

RT @ThinkstCanary
You can use a point & click canarytoken from https://canarytokens.org to help test for the #log4j / #Log4Shell issue.

1) visit https://canarytokens.org;
2) choose the Log4shell token;
3) enter the email address you wish to be notified at;
4) copy/use the returned string...
https://twitter.com/ThinkstCanary/status/1469439743905697797