ST Alpha - "Kronos (timekeeping, payroll, HR provider) offline for weeks. It starts... -- (link)" (Reading a Post)

SlickerTalk
Search Archives
The Leaderboard
The FAQ

Login
Create Account

Search Dr. S. Talk
TT/ST Wiki
How Well Do You Know ...

RSS Feed

Hosting by DigitalOcean

Support ST on Ko-Fi

Down to Post

Backboards:

Posts: 153

Kronos (timekeeping, payroll, HR provider) offline for weeks. It starts... -- (link)

Posted by oblique (aka kkuphal) Dec 14 '21, 05:35

(No message)

If you haven't heard of log4j, now you have (arstechnica.com)

Responses:

Holy crap. There’s a lot of panicking small businesses today. -- nm - spamlet Dec 14, 05:38 15
- Yea. The timing couldn't be worse for the PR company and their clients. Not just paying employees but Kronos probably tax files for most clients. - zunk xometimes Dec 14, 06:51 2
  - We use Kronos but apparently not the affected products. Ours is still online. -- nm - oblique Dec 14, 06:55 1
    - I was wondering if that's how you saw it. -- nm - spamlet Dec 14, 06:56
- so what's the issue? dumb it down for someone who hasn't read anything about this please -- nm - Beaker Dec 14, 06:15 11
  - A java logging library has a vulnerability. Basically ANY end user data logged by a system can cause the library to do a "java thing" and ask a - oblique Dec 14, 06:18 10
    - Not dumb enough for me. -- nm - Volnelk Dec 14, 06:19 9
      - heh, word -- nm - Beaker Dec 14, 06:31 1
        
        The master key to the bank vault door is available online, so they cemented the door to the bank instead. -- nm - JaxSean Dec 14, 06:35
      - bad code lets bad people steal all the personal sh!t from lots of sites or shut those sites down using ransomware -- nm - decline Dec 14, 06:24 4
        
        you just described the entire internet -- nm - oblique Dec 14, 06:25 3
        
        Right? This seems like a very level one type of problem. -- nm - Volnelk Dec 14, 06:31 2
        
        There’s an exploit found in one of the foundational languages of the Internet. Everyone with Java is highly vulnerable, so just about e’eyone. -- nm - Will Hunting Dec 14, 06:43 1
        
        Don't mind me. I knew we were all fucked. -- nm - e’eyone the donkey Dec 14, 08:39
      - Any data written to a log can cause the logging server to ask to be taken over - oblique Dec 14, 06:23
      - Everything done in a system is logged. The logs have a vulnerability. You do something, it’s logged, it executes anything you want it too -- nm - spamlet Dec 14, 06:22

Post a message top

Replies are disabled on threads older than 7 days.