Microsoft investigating Defender challenge with Log4j scanner

Microsoft is investigating studies that the Apache Log4j vulnerability scanner in Defender for Endpoint is triggering faulty alerts.

Replace: The corporate advised VentureBeat on Wednesday afternoon it has resolved the problem (see beneath).

Microsoft launched the scanner with the goal of aiding with the identification and remediation of the issues in Log4j, a well-liked logging software program element. Microsoft disclosed an enlargement of the Log4j scanning capabilities in Defender on Monday night.

False positives

Immediately, studies emerged on Twitter about false optimistic alerts from the scanner, which reportedly inform admins that “Attainable sensor tampering in reminiscence was detected by Microsoft Defender for Endpoint.” Twitter customers reported seeing the problem way back to December 23.

The studies prompted a response on Twitter from Tomer Teller, an govt in Microsoft’s safety enterprise. “Thanks for reporting this. The group is wanting into that,” Teller mentioned in a tweet.

“The group is analyzing why it triggers the alert (it shouldn’t, after all),” he wrote in a second tweet.

In response to a query from VentureBeat in regards to the studies, a Microsoft spokesperson mentioned in a press release Wednesday afternoon that “we now have resolved a difficulty for some clients who could have skilled a sequence of false-positive detections.”

On Monday, Microsoft introduced it has rolled out new capabilities in its Defender for Containers and Microsoft 365 Defender choices for addressing Log4j vulnerabilities.

The Defender for Containers resolution is now enabled to find container photographs which are susceptible to the issues in Log4j. Container photographs are scanned mechanically for vulnerabilities when they’re pushed to an Azure container registry, when pulled from an Azure container registry, and when working on a Kubernetes cluster, Microsoft’s menace intelligence group wrote in an replace to its weblog publish in regards to the Log4j vulnerability.

Defender updates

In the meantime, for Microsoft 365 Defender, the corporate mentioned it has launched a consolidated dashboard for managing threats and vulnerabilities associated to the Log4j flaws. The dashboard will “assist clients establish and remediate information, software program, and units uncovered to the Log4j vulnerabilities,” Microsoft’s menace intelligence group tweeted.

These capabilities are supported on Home windows and Home windows Server, in addition to on Linux, Microsoft mentioned. Nonetheless, for Linux, the capabilities require an replace to model 101.52.57 or later of the Microsoft Defender for Endpoint Linux consumer.

This “devoted Log4j dashboard” offers a “consolidated view of varied findings throughout susceptible units, susceptible software program, and susceptible information,” the menace intelligence groups wrote within the weblog publish.

Moreover, Microsoft mentioned it has launched a brand new schema in superior attempting to find Microsoft 365 Defender, “which surfaces file-level findings from the disk and offers the power to correlate them with extra context in superior looking.”

Microsoft mentioned it’s working so as to add assist for the capabilities in Microsoft 365 Defender for Apple’s macOS, and mentioned the capabilities for macOS units “will roll out quickly.”

Widespread vulnerabilities

Many enterprise functions and cloud providers written in Java are probably susceptible to the issues in Log4j previous to model 2.17.0. The open supply logging library is believed for use in some kind — both straight or not directly by leveraging a Java framework — by nearly all of giant organizations.

The most recent patch for Log4j, model 2.17.1, was launched Tuesday and addresses a newly found vulnerability (CVE-2021-44832). It’s the fourth patch for flaws within the Log4j software program for the reason that preliminary discovery of a distant code execution (RCE) vulnerability on December 9.

Nonetheless, various safety professionals say that the most recent vulnerability doesn’t pose an elevated safety threat for almost all of organizations. Because of this, for a lot of organizations which have already patched to model 2.17.0 of Log4j, launched December 17, it shouldn’t be vital to right away patch to model 2.17.1.

Article up to date to incorporate a response from Microsoft in regards to the decision of the false positives challenge, together with new particulars in regards to the model 2.17.1 patch for Log4j.