K7 Total Security

Total Security is our award-winning Internet Security Suite with the fastest antivirus engine on the market. It is a complete package to protect home user systems against data theft and system invasion by complex malware. The integrated Cloud based Web Protection makes your online browsing experience safer than ever. Your USB disks will be also safe with comprehensive Device Control always on alert, taking care of potential malware infections. On top of this the intelligentfirewall and spam filter are working in the background securing all incoming and outgoing traffic of your computer. Enhanced Real Time Scanner Smart file scanning algorithm to detect exploits in any file. Smart Firewall Automatic behavioral firewall with enhanced security features USB Protection Auto scans USB media for concealed threats and vaccinates USB devices from getting infected. Privacy Protection Control access to protect data that can be shared on internet. Profile Security Usernames and passwords protection for all applications and a virtual keyboard for identity protection. Disk Optimizer Optimizes disk drives so that the system performance is smooth and efficient. Permanent Data Delete Tool Erase permanently all data that you would not want the bad guys to lay hands on. Parental Control Activity Report – Monitor the internet activities of children and blocks access to hostile environment. Content filter – Protect what kind of content children are allowed to view. Comprehensive Device Control Control feature to read, write and execute access to external device. Scans USB device and prevents malicious auto runs. USB drives are immunized to prevent infection. Web Security Safe cloud based website verification and blocking of phishing and unsafe websites. Stealth mode keeps the system invisible when connected to internet. Detailed configuration option for advanced users. Automatic prompt when passwords are entered into unsecure websites. Smart IDS to stop network based attacks.

Securonix Threat Labs R&D/Securonix Threat Research team has been actively monitoring and investigating the details of the critical Log4j/Log4shell attacks (see Figure 1) [1, 3] targeting Apache Log4j/Log4shell JNDI RCE vulnerabilities (CVE-2021-44228, CVE-2021-45046).

Below are some of the key technical details and our recommendations on some possible predictive indicators/security analytics that can be used to detect the current and potentially future attack variants using Securonix.

Update 12/28: A new attack vector targeting Apache Log4j v2.x, including v2.17.0, has been reported [13]. The vector enables an attacker with a permission to modify the logging configuration file to construct a malicious configuration with a data source referencing a JNDI URI, which can then execute remote code. Based on our initial analysis, the existing Securonix log4j threat content should help detect the malicious attack activity associated with the new attack vector.

What You Need to Know

• A zero-day Apache Log4j vulnerability (CVE-2021-44228), publicly released on December 9, 2021, and known as Log4Shell, has been actively targeted in the wild since at least last week or earlier. CVE-2021-44228 has been assigned the highest “Critical” severity rating with a maximum risk score of 10.
• No-auth, arbitrary code execution as the user that the parent process, e.g. java[w].exe, is running as (can be a Java class payload code fetched from the public Internet, fetching shared secrets or environment variables and returning them to the attacker, etc.)
• A new CVE-2021-45046 has been released stating that upgrading to Log4j version 2.15.0 is insufficient and is still vulnerable to Log4Shell.
• Additional log4j attack vectors, including a DoS caused by a buffer overflow in Context Lookups (CVE-2021-45105), a client-side exploit using Websockets, a JDBC appender 2.17 RCE (CVE-2021-44832) reported, requiring an upgrade to 2.17.1.
• Further details on the vulnerability can be found here.

What You Can Do 

• Temporary Log4j workarounds, patches, and upgrades are available to address the vulnerability [1].
• Due to the nature of the vulnerability, our recommendation is to assume breach. Perform additional retroactive hunting and remediation beyond simply patching and upgrading (see our recommendations below).
• Due to a large number of possible evasion approaches, particularly for the initial infiltration, we strongly recommend not to rely solely on signature detection. Instead focus on behavior-based detections that look at the associated processes and component activity, e.g. java.exe, w3wp.exe etc., as well as network activity associated with potentially vulnerable targets, e.g. ldap/s connections, etc. (see below).