Rhombus Response to Log4j Zero Day Vulnerability
December 13, 2021On December 9th 2021, the Apache Log4j project disclosed a zero day vulnerability that affects Log4j. This vulnerability is also known as Log4Shell.
If this vulnerability exists in a service and is exploited by hackers, it could allow hackers to execute code on the affected servers and essentially gain remote operation of them.
Affected Products
Upon learning of this exploit, Rhombus took immediate action to see if any of its services used Log4j. Our analysis over the last few days found the following:
What was not affected
Rhombus Systems services do not use Log4j for logging. Our analysis confirms that:
- No mobile applications use Log4j
- No code running on Rhombus cameras or sensors uses Log4j
This means that the following products and components were NOT affected:
- Rhombus Cloud Servers
- Rhombus Web Console
- Rhombus iOS Mobile App
- Rhombus Android Mobile App
- Rhombus Apple TV App
- Rhombus Smart Cameras
- Rhombus IoT Sensors
What was affected
-
One AWS Service (OpenSearch) used by Rhombus was running the vulnerable version of Log4j.
- Rhombus is waiting for AWS to release the patch so we can apply to our production instances.
- Currently, this has no active impact to Rhombus customers. It’s undetermined if a vulnerability exists, only that the vulnerable version is present.
-
One third-party party software (Flink) uses Log4j, but not the affected version.
- Out of an abundance of caution, we are applying the patch (-Dlog4j2.formatMsgNoLookups=true) to ensure no remote JNDI lookups will occur, even if the affected version were there.
Is any action required from Rhombus users?
No. Rhombus users can continue to use the Rhombus platform as usual. All patches will be automatically applied to all Rhombus devices remotely.
Next Steps
The Rhombus Security team will continue to evaluate our services and our vendors for any potential exposure to this vulnerability. We’ll provide any updates directly to this blog post if we discover any other risks.
- Posted in
- Security Infrastructure
Related Articles
CMMC Compliance and Video Security – What You Need to Know
Initially introduced in 2020, Cybersecurity Maturity Model Certification (CMMC) establishes cybersecurity standards for defense contractors who handle sensitive information. It affects all contractors who perform work for the Department of Defense (DoD) in the United States. In this blog, we’ll look at CMMC, how it pertains to video security cameras, and how you can use video surveillance to strengthen overall security compliance throughout your organization.
NIST Compliance and Video Security – What You Need to Know
NIST represents a high standard of cybersecurity and data privacy that all organizations should aspire to. For federal agencies in the United States, NIST compliance is required. Organizations that require NIST compliance may wonder how video surveillance fits into their security strategy. In this blog, we’ll look at NIST, how it pertains to video security cameras, and how you can use video surveillance to strengthen overall security compliance throughout your entire organization.
COVID-19 Return to Work: How to Make Your Workplace Safer with Smart Physical Security Tools
As workers return to the office in the midst of Omicron, staying safe in the workplace is top of mind for employers and employees alike. To create a safer work environment, organizations need to develop and follow COVID-19 workplace policies. The CDC recommends that businesses start by “identifying where and how workers might be exposed to COVID-19 at work”. But how do you identify and assess these health risks at your workplace? In this article, we’ll discuss how smart physical security tools can help you.
