Why Haven't We Seen a Devastating Log4j Worm Yet?

There have been many alarming predictions of a devastating worm utilizing the Log4j (CVE-2021-44228) Vulnerability, but why hasn't one materialized? An introduction to worms, why they happened, what their purpose is, and why we may not see one for this

[@sandwich2473]

it's always nice to see very knowledgeable people shine light on a topic to get rid of some unnecessary fear

[@stoff1980]

Yup always good to see a banking malware author talk about malware and vulns etc

[@ko-Daegu]

@@stoff1980 didn't fbi kidnapped him and said they didn't until later said it's cuz they are investigating so why not lied once lie again

[@itsme7570]

@@stoff1980 what banking malware did he write?

[@malwareanonymous6282]

Thanks marcus I always learn new things from you! You are the best!

[@eldiablopotato]

Thank you for sharing your insights regarding a log4j worm.

[@atsurao]

Great video! Amazing explanation to be able to explain things like these so clearly!

[@ThePurpleTux]

That's actually a really good explanation. Kudos to you

[@adamsnetiker]

Great explanation! I just stumbled upon this and love how you makie it so easy to understand.

[@robertandrewww]

Great explanation as always Bellerophon

[@raghvendramishr]

Perfect explanation.

[@alex_lamarche]

thanks for the info marcus

[@adambrown3918]

Great video! Thank you so much. 😀👍

[@atlasfenix6995]

Awesome informative video!! 👍👍👍

[@calebbenson7293]

What a great video! 👍

[@chauh8401]

marcus is there anything you can't do?!! these vids are brilliant!

[@himashhimash6017]

Good one .... it is good have you on youtube and active

[@mrgermanyhd]

Great video. What do I need to do with my custom exe to bypass most AV softwares possible? I am ready for your instructions :)

[@polonia66]

Thanks

[@tonybutt2864]

Thanks, that's helpful. My thinking on this, much of which you already covered, is that the target space is too heterogenous for a worm to be effective, and there are not enough of any particular target to be useful. As well, most vulnerable servers do not use priveleged accounts. Some environments that expose (for instance) a vulnerable Splunk server could then have their internal Splunk servers compromised, which has concerned some security teams. Mostly compromises would ve for 'positional access' - a stepping stone to the rest of the environment. Limiting this is that most vulnerable software should not be running in a privileged account, so local privilege escalation is not a given. That hopefully sets the bar too high for many ransomware access brokers, but not nation states or similar. Perhaps it's plausible that this might be used to wipe logging systems after an event?

[@berndeckenfels]

Also lot of the exploits (like the one you analyzed) use a poor exploit chain (class factory which does not work on newer java runtime or does depend on specific gadget chains)

[@amberrose6978]

When are you guys gonna do another zoom chat? I miss you all. Hope all is well

[@terranovatech8672]

Not sure what you are using for noise reduction, but I'd turn it off or toggle it down. It makes your pauses completely silent and it makes it seem choppy. But aside from that, awesome Vid as always! Much love!

[@MalwareTechBlog]

Dunno, will have to look through my settings to see if I can find what's doing that

[@nagi603]

I would like to upvote, but it's az 69, which describes the video perfectly. :D Great explainer.

[@MrHappy-hs6sn]

nice

[@chauh8401]

you should look into getting an agent and doing like a netflix show!

[@th30c0der3]

ty are you back to post reverse engineering vids pleas ?

[@Versuffe]

Thank you. I can make the ultimate worm now!

[@graemepennell]

Unfortunately the human psyche wants to do things because it can, to see its results, not always because it may or may not be effective.

[@pauljones9150]

The thumbnail needs bolder text. Very nice video tho

[@pauljones9150]

And the text shouldn't double the video title.

[@hyperboy9672]

Happe..

[@oa9842]

the worm doesn't need to be there for the state agencies to take severe mitigation measures, and those measures themselves would cause the problem

[@liamowen]

A vun for the script kiddies, to deface websites like it was the 00s W.O.H style.