论文标题
易受伤害的比赛：测量log4j壳事件
The Race to the Vulnerable: Measuring the Log4j Shell Incident
论文作者
论文摘要
关键的遥控器执行（RCE）log4shell是一个严重的漏洞，于2021年12月10日向公众披露。它利用了广泛的log4j库中的错误。任何使用库并公开Internet接口的服务都可能脆弱。 在本文中，我们在披露后的两个月内测量了扫描仪的匆忙。我们使用几个优势观察研究人员和攻击者。为此，我们收集和分析由良性和恶意交流派对，其起源和流失的有效载荷。我们发现，扫描仪的最初冲刺很快消失了。尤其是非恶性扫描仪仅对披露后的几天感兴趣。相反，恶意扫描仪继续针对脆弱性。
The critical remote-code-execution (RCE) Log4Shell is a severe vulnerability that was disclosed to the public on December 10, 2021. It exploits a bug in the wide-spread Log4j library. Any service that uses the library and exposes an interface to the Internet is potentially vulnerable. In this paper, we measure the rush of scanners during the two months after the disclosure. We use several vantage points to observe both researchers and attackers. For this purpose, we collect and analyze payloads sent by benign and malicious communication parties, their origins, and churn. We find that the initial rush of scanners quickly ebbed. Especially non-malicious scanners were only interested in the days after the disclosure. In contrast, malicious scanners continue targeting the vulnerability.
