Connect with us
X
Categories:

Technology

Black Hat USA: Ox4Shell, a Log4j de-obfuscator, “dramatically” cuts down on analysis time

Published

on

Black Hat USA: Ox4Shell, a Log4j de-obfuscator, "dramatically" cuts down on analysis time
Share this post:

Open source utility exposes payloads without running vulnerable Java code.

A Log4Shell de-obfuscation tool that promises simple, rapid payload analysis without the risk of “critical side effects” has been showcased at Black Hat USA.

The open source ‘Ox4Shell’ utility was demonstrated on the Arsenal track in Las Vegas yesterday (August 10) by Daniel Abeles and Ron Vider of AppSec testing platform Oxeye.

‘True intent’

Abeles believes the tool offers a potent combination of benefits lacking among other de-obfuscators of the critical vulnerability in Apache Log4j, the Java logging utility so widely distributed that the ‘Log4Shell’ flaw (CVE-2021-44228) affects hundreds of millions of devices.

“I worked on a web application firewall [WAF] myself for several years, so I can personally relate to the struggle of understanding the true intent of obfuscated payloads and the challenge it poses to security teams,” he told The Daily Swig said in advance of his presentation.

 

The researchers couldn’t find any other tools that were as easy to use as Ox4Shell – a simple Python script – but didn’t require the user to run any vulnerable code in the process.

“We emulated most of the transformations a parallel Java code would do, without the risk of running vulnerable Java code,” Abeles said. “This is especially important when integrating such tools in a production pipeline (e.g. WAF rules), to ensure no critical side effects.”

Maximizing accuracy

With obfuscated payloads “intimidating for most security engineers” and “time-consuming and tedious” for even the most experienced, Oxeye set out “to provide the security community a lean, simple way to de-obfuscate Log4Shell payloads.”

Abeles said the needs of AppSec engineers informed the tool’s specification, while the scarcity “of public obfuscated payloads to test Ox4Shell against” prompted them to “team up with several application security teams to gather a wide variety of payloads, so we can ensure minimum false negatives and false positives rate”.

 

This process culminated with Ox4Shell’s release in January 2022, a month after Log4Shell surfaced.

RECOMMENDED  Csurf NPM package has a CSRF issue that was created to guard against similar flaws

The tool counters threat actors’ attempts to circumvent WAF rules and complicate exploit analysis, by decoding obfuscated payloads, including base64 commands, “into an intuitive and readable form” – thus revealing their “true functionality” and “dramatically” reducing security teams’ analysis time.

Mock data

Oxeye says Ox4Shell enables defenders to comply with lookup functions that attackers can abuse via Log4Shell to identify targeted machines by feeding them mock data that they can control.

A mock.json file is used to insert common values into lookup functions. “For example, if the payload contains the value ${env:HOME}, we can replace it with a custom mock value,” reads the Ox4Shell GitHub page.

This ‘lookup mocking’ means users can “replace certain data lookups with mocked data, so the final result would look more realistic and well suited to the specific organization using it”, Abeles told The Daily Swig.

A recent US government report warned that vulnerable Log4j instances could persist for “a decade or longer”. With Ox4Shell set to remain useful for some time to come, Oxeye is planning to expand the tool’s capabilities to mock even more lookup functions based on community feedback.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Realme GT Neo 7 will pack current top-performing SoC in AnTuTu's ranking — Tipster
Technology2 hours ago

Realme GT Neo 7 will pack current top-performing SoC in AnTuTu’s ranking — Tipster

Samsung Galaxy S24 FE receives October 2024 security patch following recent critical Galaxy bug
Technology2 hours ago

Samsung Galaxy S24 FE receives October 2024 security patch following recent critical Galaxy bug

The key to Kai Havertz's success at Arsenal — Mikel Arteta
Sports2 hours ago

The key to Kai Havertz’s success at Arsenal — Mikel Arteta

Martin Odegaard gives injury update ahead of Arsenal vs Southampton
Sports3 hours ago

Martin Odegaard gives injury update ahead of Arsenal vs Southampton

The government orders evacuation as Ondo suffers greatly by flooding
News3 hours ago

The government orders evacuation as Ondo suffers greatly by flooding

Ogun State commissioner salutes teachers’ resilience and courage
News3 hours ago

Ogun State commissioner salutes teachers’ resilience and courage

Police arrest suspected serial killer in Ogun State
News4 hours ago

Police arrest suspected serial killer in Ogun State

Success not only defined by winning awards — Adediwura Blarkgold
Entertainment4 hours ago

Success not only defined by winning awards — Adediwura Blarkgold

I’m not interested in BBL — Ebun Hodo
Entertainment4 hours ago

I’m not interested in BBL — Ebun Hodo

Memories of how "Alaga Ibile" transformed his life and sold 13 million copies — Reminisce
Entertainment6 hours ago

Memories of how “Alaga Ibile” transformed his life and sold 13 million copies — Reminisce

Chris Brown sells out Africa's largest stadium in just 2 hours
Entertainment6 hours ago

Chris Brown sells out Africa’s largest stadium in just 2 hours

Apple's upcoming affordable iPhone would allegedly mix features from past three flagships
Technology17 hours ago

Apple’s upcoming affordable iPhone would allegedly mix features from past three flagships

Robot vacuum from prominent brand has cameras and speakers hacked, according to report
Technology17 hours ago

Robot vacuum from prominent brand has cameras and speakers hacked, according to report

Arsenal reacts to the Brazilian team's "in recent days" bid for Gabriel Jesus
Sports17 hours ago

Arsenal reacts to the Brazilian team’s “in recent days” bid for Gabriel Jesus

Tyson Fury compared to Vladimir Putin following foul-mouthed outburst before of Oleksandr Usyk's rematch
Sports17 hours ago

Tyson Fury compared to Vladimir Putin following foul-mouthed outburst before of Oleksandr Usyk’s rematch

Rapper Phyno denies the Olamide similarity, claims they are brothers
Entertainment17 hours ago

Rapper Phyno denies the Olamide similarity, claims they are brothers

‘Thousands’ of fake Oasis tickets appear before North America tour sale starts
Entertainment18 hours ago

‘Thousands’ of fake Oasis tickets appear before North America tour sale starts

Why Billie Eilish fans meowing at her concert?
Entertainment18 hours ago

Why Billie Eilish fans meowing at her concert?

Pastor Enoch Adeboye apologizes for tithing remarks
News18 hours ago

Pastor Enoch Adeboye apologizes for tithing remarks

Tinubu’s aide: CFR honours not to undermine Reps
News18 hours ago

Tinubu’s aide: CFR honours not to undermine Reps

Ogun State commissioner salutes teachers’ resilience and courage
News19 hours ago

Ogun State threatens to shut private schools not complying with education policy

Oura Ring 4 promises 'most accurate' health monitoring
Technology2 days ago

Oura Ring 4 promises ‘most accurate’ health monitoring

A significant change to video calls is imminent — WhatsApp
Technology2 days ago

A significant change to video calls is imminent — WhatsApp

Ray Parlour responds to Frank Lampard’s claim about William Saliba and Gabriel Magalhaes
Sports2 days ago

Ray Parlour responds to Frank Lampard’s claim about William Saliba and Gabriel Magalhaes

Sean Dyche makes Jarrad Branthwaite claim amid Manchester United and Liverpool interest
Sports2 days ago

Sean Dyche makes Jarrad Branthwaite claim amid Manchester United and Liverpool interest

ICPC recovered N13bn looted funds in Sept – Musa Aliyu
News2 days ago

ICPC recovered N13bn looted funds in Sept – Musa Aliyu

FG stops VAT on diesel, cooking gas
News2 days ago

FG stops VAT on diesel, cooking gas

Naira notes Emefiele released was not what Buhari approved — Witness
News2 days ago

Naira notes Emefiele released was not what Buhari approved — Witness

Wizkid previews two new songs as he gears up for the release of 'Morayo'
Entertainment2 days ago

Wizkid previews two new songs as he gears up for the release of ‘Morayo’

Jade Osiberu is under fire for her 2022 post about Peter Obi
Entertainment2 days ago

Jade Osiberu is under fire for her 2022 post about Peter Obi

Karen Igho opens up about marital struggles, “I'm homeless”
Entertainment2 days ago

Karen Igho opens up about marital struggles, “I’m homeless”

Microsoft Office 2024 is available now without a subscription, with new features and design
Technology3 days ago

Microsoft Office 2024 is available now without a subscription, with new features and design

Redmi Note 14 Pro+ is ranked as the latest mid-range phone in the AnTuTu top 10
Technology3 days ago

Redmi Note 14 Pro+ is ranked as the latest mid-range phone in the AnTuTu top 10

If we go on strike, put the blame on FG — ASUU
News3 days ago

If we go on strike, put the blame on FG — ASUU

Edo Assembly recalls two members after five months suspension
News3 days ago

Edo Assembly recalls two members after five months suspension

Tinubu departs for the UK for a two-week annual leave
News3 days ago

Tinubu departs for the UK for a two-week annual leave

Manchester United players want Ruud van Nistelrooy to take charge if Erik ten Hag gets sacked
Sports3 days ago

Manchester United players want Ruud van Nistelrooy to take charge if Erik ten Hag gets sacked

Mikel Merino describes the strange injury that kept him from making his Arsenal debut
Sports3 days ago

Mikel Merino describes the strange injury that kept him from making his Arsenal debut

Wizkid takes another swipe at Davido in fiery exchange, ‘No talent’
Entertainment3 days ago

Wizkid takes another swipe at Davido in fiery exchange, ‘No talent’

3-time Oscar winner Sir Daniel Day-Lewis unretires from acting to appear in debut film from son
Entertainment3 days ago

3-time Oscar winner Sir Daniel Day-Lewis unretires from acting to appear in debut film from son

OnePlus 13 model number, charging specs register in new leak
Technology7 days ago

OnePlus 13 model number, charging specs register in new leak

Kylian Mbappe celebrates after scoring a goal for PSG against Juventus in the Champions League
ANE Football Analytical6 days ago

What About PSG, Ligue 1 after Mbappe’s Transfer to Real Madrid

Mbappe and Kylian Mbappe
ANE Football Analytical6 days ago

France Brothers: Dembele Tricked into Joining PSG, Deserted by Mbappe

China open to more loans, investments in Nigeria — FG
News5 days ago

China open to more loans, investments in Nigeria — FG

Warning against female genital mutilation — Kwara agency
News6 days ago

Warning against female genital mutilation — Kwara agency

Why Anthony Joshua was "suspended" after losing to Daniel Dubois by knockout
Sports5 days ago

Why Anthony Joshua was “suspended” after losing to Daniel Dubois by knockout

Cole Palmer hailed as the ‘best player in the Premier League’
Sports6 days ago

Cole Palmer hailed as the ‘best player in the Premier League’

Fubara’s kinsmen apologise to Wike — We are sorry
News7 days ago

Fubara’s kinsmen apologise to Wike — We are sorry

Phyno featuring British rap artist Arrdee on his latest single, "Time of my Life"
Entertainment5 days ago

Phyno featuring British rap artist Arrdee on his latest single, “Time of my Life”

Cole Palmer hailed as the ‘best player in the Premier League’
Sports7 days ago

Enzo Maresca reveals what he told Cole Palmer following four-goal Chelsea haul

Bobrisky: Reps question NCoS and EFCC officials over alleged bribery
Entertainment7 days ago

How Bobrisky spent jail term in Kirikiri special cell

Bobrisky: Falz ready for legal battle as VDM alleges threat to life
Entertainment7 days ago

Bobrisky: Falz ready for legal battle as VDM alleges threat to life

Pedri blames referee for Barcelona’s first league defeat
Sports6 days ago

Pedri blames referee for Barcelona’s first league defeat

Oyo High Court summons Kemi Alao-Akala over late ex- gov’s estate
News7 days ago

Oyo High Court summons Kemi Alao-Akala over late ex- gov’s estate

Netflix has recently introduced a forgotten BBC masterpiece
Entertainment6 days ago

Netflix has recently introduced a forgotten BBC masterpiece

Kobbie Mainoo and Alejandro Garnacho have ‘Manchester United DNA’ — Patrice Evra
Sports4 days ago

Kobbie Mainoo and Alejandro Garnacho have ‘Manchester United DNA’ — Patrice Evra

If we go on strike, put the blame on FG — ASUU
News5 days ago

FG raises teams in order to avert the ASUU strike

Shaibu disputes a plan to storm the Edo government house
News5 days ago

Shaibu disputes a plan to storm the Edo government house

Nigeria@64: We must reform or collapse — President Tinubu
News7 days ago

Nigeria must remain giant of Africa — Tinubu tasks Armed Forces

Manchester United make decision on Erik ten Hag future after Tottenham humiliation
Sports6 days ago

Manchester United youngsters to step up amid transfer ‘restrictions’ — Erik ten Hag

Bobrisky: Reps question NCoS and EFCC officials over alleged bribery
Entertainment4 days ago

Bobrisky: Reps question NCoS and EFCC officials over alleged bribery

Country music legend Kris Kristofferson dies aged 88
Entertainment5 days ago

Country music legend Kris Kristofferson dies aged 88

Actors you totally forgot appeared in James Bond films
Entertainment6 days ago

Actors you totally forgot appeared in James Bond films

X Factor stars G4 continue their 20th-anniversary tour after devastating death of bandmate
Entertainment6 days ago

X Factor stars G4 continue their 20th-anniversary tour after devastating death of bandmate

Forewarned: Listening to these pop stars will make you lustful
Entertainment7 days ago

Forewarned: Listening to these pop stars will make you lustful

Nigeria@64: We must reform or collapse — President Tinubu
News4 days ago

Nigeria@64: We must reform or collapse — President Tinubu

Pep Guardiola provides Erling Haaland injury update after Manchester City draws
Sports7 days ago

Pep Guardiola provides Erling Haaland injury update after Manchester City draws

#October1protest: Sowore joins protesters in Lagos
News4 days ago

#October1protest: Sowore joins protesters in Lagos

Edo community protests Obaseki’s choice of traditional ruler
News6 days ago

Edo community protests Obaseki’s choice of traditional ruler

#FearlessOctober1 protest: It will hold at Eagle Square — Organisers tell police
News6 days ago

#FearlessOctober1 protest: It will hold at Eagle Square — Organisers tell police

Chris Martin reveals the precise day Coldplay will officially retire
Entertainment5 days ago

Chris Martin reveals the precise day Coldplay will officially retire

Smart window generates electricity from raindrops, without solar cells
Technology7 days ago

Smart window generates electricity from raindrops, without solar cells

Legion Y700: Lenovo launches new gaming tablet with a competitive starting price
Technology6 days ago

Legion Y700: Lenovo launches new gaming tablet with a competitive starting price

Puff Diddy taken off suicide watch in jail, receives visit from family
Entertainment4 days ago

Puff Diddy taken off suicide watch in jail, receives visit from family

Manchester United make decision on Erik ten Hag future after Tottenham humiliation
Sports5 days ago

Manchester United make decision on Erik ten Hag future after Tottenham humiliation

Nigeria@64: Revisiting prominent political-musical intersections
Entertainment4 days ago

Nigeria@64: Revisiting prominent political-musical intersections

Declan Rice addresses allegations that Arsenal is “cheating” in Premier League matches
Sports5 days ago

Declan Rice addresses allegations that Arsenal is “cheating” in Premier League matches

Expert advises companies to use AI for more intelligent operations
Technology5 days ago

Expert advises companies to use AI for more intelligent operations

IBM, UNDP unveil AI solutions for clean energy promotion
Technology5 days ago

IBM, UNDP unveil AI solutions for clean energy promotion

Lenovo Chromebook Duet 11 launches with a refreshed design,
Technology4 days ago

Lenovo Chromebook Duet 11 launches with a refreshed design

ANE Billboard Hots