As we all know, Log4j is a ubiquitous piece of software used to record activities in a wide range of systems found in consumer-facing products and services. The discovery of the recent vulnerability in the Java logging package (CVE-2021-4428) This risk posed a severe threat to millions of consumer products, from enterprise software to web applications. It presents a risk of loss or breach of personal information, financial loss, and irreversible reputation harm. Currently, the FTC is taking action to require organizations to settle any associated risk caused by the known vulnerabilities. The FTC is now noted as using its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure.
A recent example of this negligence came from a complaint regarding Equifax’s failure to patch a known vulnerability that irreversibly exposed the personally identifiable information of 147 million consumers. This resulted in Equifax paying $700 million to settle the actions taken by the FTC and the Consumer Financial Protection Bureau. The risk for businesses is therefore clear: take actionable steps to remediate the vulnerability or face litigation, breach risk, and reputation damage.
In this guide, we will walk you through how you can use Method Call Removal to mitigate this vulnerability.
Method Call Removal has been available since our DashO 6.11 release. It is mostly used to remove logging statements, but it can also strip any method calls we’d prefer not to have in our production release. The only caveat is that the method definition must also be in DashO’s input.
Let’s assume Log4j is used for our application’s logging. We might want to remove all log statements from production builds and create special debug builds with logging enabled as needed. Or, we might want to remove Info, Warn, and Debug messages but retain Error or Fatal messages in our production build. This can be done using DashO’s Method Call Removal feature without adjusting the Log4j configuration.
This application logs informational messages when the app starts, and when it shuts down.
The Log4J configuration has been organized into a global logging class:
In our DashO project, I’ll select the “LogInfo” method for method call removal:
After doing so, the application runs normally, but informational messages are no longer logged to the console or written to the log file.
After the app has been in production, I may need to create an obfuscated debug build for troubleshooting an issue with a specific client. If so, I can run DashO without Method Call Removal to preserve logging calls in my debug build.
If you have any feedback on this topic or other topics you would like us to discuss in the Support Corner, please contact our Support Department.