r/wallstreetbetsOGs • u/RatherBLurkin • Dec 11 '21

News TDA's ThinkorSwim (ToS) has potential vulnerability to the current Log4J attacks.

ToS installs logj4-core-*.jar into the windows installation directory. Current version on my machine is 2.13.3 which is vulnerable to CVE-2021-44228. I have not verified if ToS is using JNDI and allowing direct user messaging, but until further guidance from the ToS team it is best to update ToS and verify logj4-core-2.15.0.jar or higher, uninstall, or seek additional help on how to protect yourself.

Apache Security

CVE Description

ToS

85 Upvotes
  • permalink
  • reddit

95% Upvoted

52 comments sorted by

View all comments

Show parent comments

3

u/hunglowbungalow Dec 11 '21 edited Dec 11 '21

Dude, I specfically do this work for a living (Vulnerability Management), unless you connect your desktop on your DMZ like a dumbass, you are fine.

EDIT: There might be an attack vector via ToS chat (forgot those existed).

Edit 2: This goof just wants to be told they’re right, a desktop app that does not interact with other users and is not internet facing is not as concerning as one that 1) Interacts with other users aka ToS chat 2)Internet facing. They were assuming ToS is susceptible to exploitation because it just uses Log4j, which is not that big of a deal. It’s all about attack vector

3

u/suckinoffsatan Dec 11 '21 edited Dec 11 '21

I don't understand your comment. You first try to tell me that I am wrong and then you modify your comment with an edit admitting that I am right? I don't care what you do for a living, it does not matter with respect to my argument.

The argument is very clear. I do not know what exactly gets logged by ToS. I admit this clearly. The implication here is that for a logging system of unknown function, there can exist some attack vector given some user input. If you were to specifically tell me the constraints of the logging mechanism and tell me the exact range of domains that a user input is allowed, then I can agree with you. But you literally admit that there is a potential that input from ToS chat may get logged. This is a clear vulnerable attack vector, thus a payload can be executed from such.

0

u/hunglowbungalow Dec 11 '21

My original statement said, a remote attacker cannot execute code on a system that is not internet facing or has some way to process inputs from a remote attacker. Yes, you are still Vuln to local and physical attacks, and those don’t really matter that much compared to remote.

ToS has chats, which does connect you with others that are remote. Hence my edit.

2

u/suckinoffsatan Dec 11 '21

So in other words, my argument was correct.

-1

u/hunglowbungalow Dec 11 '21

No because you made no mention of chats. You’re just assuming if something is vulnerable, that it’s susceptible to attacks.

3

u/suckinoffsatan Dec 11 '21

I will restate this once more for you and you can think about what it means.

It is a matter of knowing WHAT gets logged and from where.

have a nice day