弱势群体的竞争：衡量Log4j壳牌事件
The Race to the Vulnerable: Measuring the Log4j Shell Incident
摘要：
关键的远程代码执行（RCE）Log4Shell是一个严重的漏洞，于2021年12月10日向公众披露。它利用了广泛使用的Log4j库中的一个bug。任何使用该库并向Internet公开接口的服务都可能存在漏洞。在本文中，我们测量了在披露后的两个月内扫描仪的匆忙。我们使用几个有利位置来观察研究人员和攻击者。为此，我们收集和分析良性和恶意通信方发送的有效载荷，它们的来源和流失。我们发现扫描仪最初的热潮很快就消退了。特别是非恶意扫描程序只对披露后的几天感兴趣。相反，恶意扫描程序继续瞄准漏洞。
英文摘要：
The critical remote-code-execution (RCE) Log4Shell is a severe vulnerability that was disclosed to the public on December 10, 2021. It exploits a bug in the wide-spread Log4j library. Any service that uses the library and exposes an interface to the Internet is potentially vulnerable. In this paper, we measure the rush of scanners during the two months after the disclosure. We use several vantage points to observe both researchers and attackers. For this purpose, we collect and analyze payloads sent by benign and malicious communication parties, their origins, and churn. We find that the initial rush of scanners quickly ebbed. Especially non-malicious scanners were only interested in the days after the disclosure. In contrast, malicious scanners continue targeting the vulnerability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
