On Dec. 9 , a remote code execution (RCE) vulnerability in Apache log4j 2 was identified being exploited in the wild. Apache log4j is an open source logging utility that is leveraged within numerous Java applications around the world. The release of public proof of concept (PoC) code and subsequent investigation revealed that the exploitation was incredibly easy to perform. By submitting a specially crafted request to a vulnerable system, the attacker is able to instruct the system to download and subsequently execute a malicious payload. 

 

Due to its recent discovery, there are still many on-premises and cloud servers that have yet to be patched. The exploit code for the CVE-2021-44228 vulnerability has been made publicly available, and massive scanning activity has begun on the internet with the intent of seeking out and exploiting unpatched systems. The Unit 42 Threat Intel and product development teams continue to monitor this situation for additional developments and will share the latest information on the exploit and how to defend

against it. 

 

Join Jen Miller-Osborn, Deputy Director for Unit 42 Threat Research to learn:

  • Key details and analysis about the vulnerability

  • How to determine whether your organization is vulnerable

  • Recommended mitigations
  • What Palo Alto Networks products will do to prevent this vulnerability from being exploited


Featured Speaker

Jen Miller-Osborn


Deputy Director of Threat Intelligence for Unit 42 at Palo Alto Networks


Jen Miller-Osborn is the Deputy Director of Threat Intelligence for Unit 42 at Palo Alto Networks. Her focus is detecting, identifying and differentiating between cyber espionage and cyber crime actors and groups.


For more than 10 years, Jen has worked in cyber threat intelligence and served as a subject matter expert to multiple U.S. federal agencies. She has influenced national cyber security policies and regularly briefed at all levels of government. 


A veteran of the U.S. Air Force, Jen is fluent in Mandarin Chinese. She has several degrees and technical certifications, including a Master of Science degree in information technology from the University of Maryland.