Code42 response to industry security incidents

Overview

When other security and technology companies disclose breaches and other security events, we often receive questions about whether those incidents affect Code42 products and services. This page provides information about if and how major, widely publicized breaches affect Code42 products and services.

Code42 constantly reviews and analyzes any security incidents that could impact our customers, products, and services. In addition to the list below, there may be other security incidents that we are reviewing. Because security incident details provide sensitive information that could be used maliciously, we are unable to publish information about every incident we review.

If a security event affects Code42 products and services, we contact affected customers and issue a security advisory.

If you have questions or concerns, contact our Customer Champions for support.

Atlassian remote code execution vulnerability

June 21, 2022

Incident: On June 3, 2022, Atlassian published a security advisory for CVE-2022-26134 based on a zero-day exploit Volexity published on June 2, 2022. In affected versions of Confluence Server and Data Center, an Object-Graph Navigation Language (OGNL) injection vulnerability exists that could allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.

Code42 impact: Code42 does use Atlassian technology in our internal corporate environment. We applied the recommended mitigation to address the vulnerability as soon we were made aware of the vulnerability. A review of internal security tools and telemetry verified that no anomalies were detected.

Microsoft Support Diagnostic Tool vulnerability

June 14, 2022

Incident: On Monday, May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. Microsoft's documentations states, "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights."

Code42 impact: Code42 does not use Microsoft Windows or Office in our products. However, Code42 does use Microsoft products in our internal corporate environment. We verified that no servers are running Microsoft Office applications. In addition, we removed the registry key where applicable to mitigate these vulnerabilities, as documented in Microsoft's suggested workaround. A review of internal security tools and telemetry verified that no anomalies were detected.

VMware authentication bypass vulnerability

May 23, 2022

Based on guidance provided by CISA, Code42 completed an analysis of affected VMware instances in our internal corporate environment. Based on that analysis, Code42 applied patches where applicable, conducted a security analysis, and verified that no anomalies were detected.

May 18, 2022

Incident: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate. CISA has published Emergency Directive 22-03 in response.

Code42 impact: Code42 products do not use VMware technology as part of the production environment. However, Code42 does use affected VMware technology in our internal corporate environment. These instances are not accessible from the internet. We are taking the appropriate steps to mitigate these vulnerabilities and will provide additional updates as they are available.

F5 remote code execution

May 9, 2022

Incident: On May 4, 2022, F5 announced CVE-2022-1388, which details a critical remote code execution vulnerability in BIG-IP networking devices.

Code42 impact: Code42 does not use F5 products. As a result, there is no known impact to Code42’s products or services from this incident.

Java Spring Framework vulnerability

March 31, 2022

Incident: A zero-day vulnerability found in the popular Java web application development framework Spring (CVE-2022-22965) puts a wide variety of web apps at risk of remote attack. The vulnerability — referenced as "Spring4Shell" and "SpringShell" by some security firms — can be exploited remotely if a Spring application is deployed to an Apache Tomcat server using a common configuration.

Code42 impact: Code42 does use Spring in some of our cloud services, but they are not vulnerable to CVE-2022-22965, per the information provided by Spring. In addition, Code42 agents do not use Spring at all so are also not affected. As a further point of mitigation, Code42 will update to the latest patched version of Spring Boot and the Spring Framework in future product releases.

The Code42 security and product teams are continuing to monitor this vulnerability and will take action as necessary if and when additional information is released.

Okta LAPSUS$ hacking group incident

March 25, 2022

We have received confirmation from Okta that Code42 is not one of the few customers affected by this incident. As a result, there is no known impact to Code42’s products or services from this incident.

March 22, 2022

Incident: The LAPSUS$ hacking group posted screenshots on Telegram claiming they obtained access to Okta.com Superuser/Admin and various other systems. As of March 22, 2022, Okta has publicly stated the images were related to an incident detected and contained in January 2022.

Code42 impact: We are aware of the current incident reports tied to Okta support user access. While Code42 uses Okta for authentication for internal applications, we have confirmed that Code42 does not have Okta support access enabled within our environment. As an additional precaution, we also have reviewed logs for the last six months and have not seen any unusual or malicious activity from support users.

Ukraine-Russia war

March 2, 2022

Code42 is closely monitoring the cybersecurity implications of the Ukraine-Russia war and will adjust to potential threats to the business as they emerge.

Log4j library vulnerability

Summary

Date: December 10, 2021 - February 2, 2022
Organization / Product: Apache Log4j
Incident: Apache announced multiple vulnerabilities within the Log4j library.
Affected Code42 components:
- Code42 cloud: Updated Log4j from 2.15.0 to 2.17.1 on January 26, 2022
- Code42 app for Incydr Basic and Advanced and CrashPlan Cloud product plans: Updated Log4j from 2.16.0 to 2.17.1 on January 18, 2022
- Code42 User Directory Sync (UDS): Updated Log4j from 2.15.0 to 2.17.1 on February 2, 2022
- On-premises Code42 server: Mitigated from Log4j vulnerabilities by following these steps
- On-premises Code42 app: Updated to Log4j 2.16 on December 17, 2021
Not affected:
- Code42 app for Incydr Professional, Enterprise, and Horizon product plans

Code42 impact

Date	Update
April 21, 2022	A privilege escalation vulnerability was discovered in the Amazon Web Services (AWS) hotfix for the Log4j vulnerabilities. This issue is detailed in CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, and CVE-2022-0071. Code42 did not apply the AWS hotfix during our mitigation of the Log4j vulnerabilities. As a result, there is no known impact to Code42’s products or services from this incident.
February 2, 2022	Code42 products and services Code42 released User Directory Sync (UDS) version 1.6.4, which updated the Log4j library from version 2.15.0 to version 2.17.1 to further mitigate CVE-2021-45105, CVE-2021-44832, and CVE- 2021-45046. Most Code42 customers do not have access to or use the UDS service, but if you are affected and need assistance applying the UDS upgrade in your environment, contact our Customer Champions for support.
January 26, 2022	Code42 products and services Code42 released updates to the Code42 cloud infrastructure, which updated the Log4j library from version 2.15.0 to version 2.17.1 to further mitigate CVE-2021-45105, CVE-2021-44832, and CVE- 2021-45046.
January 18, 2022 2:00 pm ET	Code42 products and services Code42 released app version 8.8.2, which updated the Log4j library from version 2.16.0 to 2.17.1 to further mitigate CVE-2021-45105, CVE-2021-44832, and CVE- 2021-45046. Customers with delayed client upgrades are encouraged to review settings and update immediately.
December 20, 2021 2:40 pm ET	All deployments for Log4j 2.17 We will continue to apply additional patches for Log4j as they are released. Based on NIST guidelines as of December 20, 2021, Log4j 2.17 updates will be made as part of ongoing patch cycles in January 2022. Code42 will adjust planned upgrade cycles should requirements and guidelines change. Additional context for Code42's approach to updating to Log4j 2.17 The vulnerability outlined in 2.16 references an attack with control over Thread Context Map data to cause a denial of service. Code42 products and services do not provide a way for an attacker to control Thread Context Map data. Code42 products and services do not use any non-default logging patterns involving the Thread Context Map, which is required for exploitation. Code42 has completed Red Team attacks and have engaged with security researchers via our bug bounty program to ensure we are not vulnerable to what is being described within Log4j version 2.16. Cloud deployments for Log4j 2.16 Code42 app - An update to Log4j 2.16 was released December 20th, 2021. Code42 cloud and services - Some services have been updated and will continue to update as new releases are applied. All areas of Cloud and Services will be completed as part of ongoing patch cycles in January 2022. See below for additional context regarding Code42's approach to updating to Log4j 2.16.
December 17, 2021 4:45 pm ET	In line with guidance from CISA and NIST, Code42 is in the process of applying Log4j 2.16 to its products and services according to an accelerated timeline. Based on extensive testing, we do not believe that Code42 products and services are susceptible to risk presented by CVE- 2021-45046 once all currently available patches and mitigations as documented below have been implemented. Current timeline for updating to Log4j 2.16: On-premises deployments Code42 app - Code42 app version 8.2.3 released on December 17, 2021 Authority and storage servers - Mitigation instructions provided on December 13, 2021 Cloud deployments Code42 app - Timeline for update currently being determined; updates to be provided the week of December 20, 2021 Code42 cloud and services - Timeline for update currently being determined; updates to be provided the week of December 20, 2021
December 16, 2021 10:25 am ET	Code42 products Code42 released updates to the Code42 cloud infrastructure with an updated version of Log4j that mitigates the CVE-2021-44228 vulnerability. Customers were made aware of the cloud infrastructure and Code42 app version 8.8.1 update via the Code42 Community and direct email.
December 15, 2021 2:40 pm ET	Code42 services Code42 released User Directory Sync (UDS) version 1.6.3 with an updated version of Log4j that mitigates the CVE-2021-44228 vulnerability. Most Code42 customers do not have access to or use the UDS service, but affected customers were emailed directly at approximately 10:30 pm ET on December 14th, 2021, with upgrade instructions and download links to the new UDS version. If you need assistance applying the UDS upgrade in your environment, contact our Customer Champions for support.
December 15, 2021 8:45 am ET	Updated December 17, 2021 at 5:35 pm ET with additional details: Additional context for Code42 approach to updating to Log4j 2.16 We have completed Red Team attacks and have been engaged with security researchers via our Bug Bounty program to ensure we are not vulnerable to what is being described in CVE-2021-45046. Our agent and cloud services have a common lib-logging library which wraps our usage of Log4j. This constrains our usage down a standard path (default configuration) that does not utilize any of the vulnerable methods (ThreadContexMap, Logger.printF, or the other formattable stringBuilder) found to date. We were previously and are currently running a JVM version of 11.0.1 or higher which mitigates against many of the RCE known exploits. We have completed a scan of our code to ensure it does not use non-standard configurations which are outlined as part of the attack path for this vulnerability. Many of the reported “bypass” attempts require either other known vulnerable dependencies be loaded or opt-in to known vulnerable configurations. We have confirmed our products are not vulnerable to the “bypass” exploits reported to date. Updated December 16, 2021 at 1:10 pm ET with additional details: After Log4j version 2.15 was released and applied to Code42 products, a newer Log4j version (2.16) was released that remediates additional vulnerabilities. We have assessed version 2.16 and determined it does not remediate vulnerabilities in Code42 products. Therefore, we will not be doing an emergency patch to apply Log4j 2.16 because version 2.15 addresses the critical vulnerability. Version 2.16 addresses a very specific edge case related to a logging configuration that we do not use in our products. As always, we will be monitoring for updated versions and apply those versions as necessary.
December 14, 2021 5:12 pm ET	Code42 products and services Code42 has released app version 8.8.1 to mitigate CVE-2021-44228 (Log4j vulnerability). Customers with delayed client upgrades are encouraged to review settings and update immediately. Code42 is planning for additional updates to the Code42 cloud later this week. If you’re an on-premises customer and need additional details regarding mitigation, see Log4j vulnerability remediation steps for on-premises Code42 servers. We will provide additional updates regarding further mitigation for on-premises customers later this week.
December 13, 2021 7:45 pm ET	Code42 is working toward a patch to mitigate CVE-2021-44228 that will be available by the end of this week (December 17, 2021).
December 13, 2021 3:25 pm ET	Code42 products and services Code42 is continuing to review the impact of CVE-2021-44228 (Log4j vulnerability) beyond remote code execution (RCE). We are working through applying the latest version of Log4j in all impacted areas of our product. Once updates are fully applied, additional messaging will be provided here as well as via email to all customers. If you’re an on-premises customer and need additional details regarding mitigation, see Log4j vulnerability remediation steps for on-premises Code42 servers.
December 10, 2021 7:30 pm ET	Code42 services Code42 User Directory Sync uses a Log4j version that is vulnerable to CVE 2021-44228; most Code42 customers do not have access to or use this service. If configured according to Code42 guidelines, this service is not accessible to the public internet and therefore has mitigation in place. If you are concerned about this vulnerability in your environment, please contact support at https://gethelp.code42.com/ for further information. In the coming weeks, Code42 will provide an update to Code42 User Directory Sync that will use a Log4j version that is not vulnerable to CVE 2021-44228.
December 10, 2021 4:45 pm ET (original message)	Code42 product Code42 does use Java within Code42 products, but current releases of all affected services and agents leverage a JVM (Java virtual machine) version higher than 11.0.1, which prevents the remote code execution vulnerability from execution. As a further point of mitigation, Code42 will update to the latest patched version of Log4j as part of future product releases. In addition, Code42 does not leverage Apache Tomcat or Apache Struts components as part of our products. Code42 internal corporate applications Code42 also leverages Java on specific internal corporate applications. These applications are currently being reviewed for potential impact and are scheduled for patching.

Previous industry incidents

Date	Organization / Product	Incident	Code42 impact
July 2, 2021	Kaseya VSA remote management service	Kaseya was struck by a ransomware attack, which spread to an estimated 1,500 businesses around the world. It is believed that attackers exploited a zero-day vulnerability in the Kaseya VSA remote management service, which the company says is used by 35,000 customers.	Code42 does not use Kaseya products. There is no known impact to Code42’s products or services as a result of this attack.
June 30, 2021	Microsoft Windows Print Spooler service	A vulnerability (CVE-2021-34527) in the Microsoft Windows Print Spooler service, known colloquially as PrintNightmare, allows an attacker to remotely execute code with system level privileges. A threat actor exploiting this vulnerability can compromise the entire identity infrastructure of a targeted organization. References: Microsoft Support ArsTechnica story	Code42 products are not vulnerable to this threat. If you are a Code42 customer, your Code42 environment is not affected. However, Code42 does use affected Microsoft Windows technology in our internal corporate environment. We have taken the appropriate steps to mitigate this vulnerability. Between June 30 and July 9, Code42 took the following actions: June 30 - Disabled Print Spooler functionality where possible on impacted devices, including putting in place file system access restrictions for one server where the spooler service was operationally necessary July 6 - Updated system monitor configurations and logging July 8 - Applied Microsoft patches July 9 - Configured registry settings via group policy for disabling point and print
April 20, 2021	Pulse Connect Secure (PCS 9.0R3 and higher)	A vulnerability was discovered in Pulse Connect Secure (PCS). This vulnerability includes an authentication bypass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway.	Code42 does not use Pulse Connect Secure. There is no known impact to Code42’s products or services as a result of this vulnerability disclosure.
April 20, 2021	SonicWall Email Security	Three zero-day vulnerabilities in SonicWall’s Email Security (ES) product were found exploited in the wild. These vulnerabilities were executed together to obtain administrative access and carry out code execution on a SonicWall ES device.	Code42 does not use SonicWall Email Security. There is no known impact to Code42’s products or services as a result of this vulnerability disclosure.
March 10, 2021	F5 Networks BIG-IP and BIG-IQ	F5 announced 21 CVEs, including four critical vulnerabilities. These vulnerabilities could allow for remote command execution. Alongside disclosure of the vulnerabilities, F5 Networks issued patches for both the BIG-IP and BIG-IQ platforms	Code42 does not use F5 Networks’ BIG-IP or BIG-IQ. There is no known impact to Code42’s products or services as a result of this incident.
March 8, 2021	Verkada	An entity calling itself APT69420 claims to have gained unauthorized global access to Verkada’s security camera and facial recognition system. The third-party was able to view video feeds and facial recognition data for numerous large customers of Verkada’s surveillance system product. This breach was independently verified by Bloomberg and involved access using a super-user account.	Code42 does not use Verkada. There is no known impact to Code42’s products or services as a result of this incident.
March 2, 2021	Microsoft Exchange	Microsoft announced that hackers working on behalf of the Chinese government were actively exploiting 0-day vulnerabilities in on-premises Microsoft Exchange servers. Microsoft issued emergency patches and urged all customers with on-premises Exchange to immediately patch their systems. The Exchange vulnerabilities have been assigned the following CVEs: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065.	Code42 does not use Microsoft Exchange. There is no known impact to Code42’s products or services as a result of this incident.
February 1, 2021	Accellion FTA	Accellion identified a concerted cyber-attack against their legacy FTA product. Accellion patched the actively exploited vulnerabilities and worked until January 2021 to identify and patch additional undiscovered vulnerabilities.	Code42 does not use Accellion technologies. There is no known impact to Code42’s products or services as a result of this incident.
December 13, 2020	SolarWinds	Malware inserted into a service that provided software updates for the Orion platform	Code42 does not use SolarWinds Orion. There is no known impact to Code42’s products or services as a result of this incident.

Other resources

Code42: Security