Timeline for Does the Log4j vulnerability affect Android users?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 13, 2021 at 17:36 | history | edited | Andrew T.♦ | CC BY-SA 4.0 |
copyedit
|
| Dec 13, 2021 at 17:16 | history | became hot network question | |||
| Dec 13, 2021 at 15:00 | history | tweeted | twitter.com/StackAndroid/status/1470408203670335488 | ||
| Dec 13, 2021 at 3:44 | answer | added | Morrison Chang | timeline score: 73 | |
| Dec 12, 2021 at 11:57 | comment | added | mistes | @Robert wait when you said android native logging does not support formatting, did you mean android logging as in the logs of actions and interactions of apps on the device? like the stuff you see when you use logcat? | |
| Dec 12, 2021 at 11:40 | comment | added | mistes | @Robert Thank you. That reassures me a bit. Some users on twitter changed their profile name into a log4j attack vector (most probably to test it against twitter servers). I ,unwittingly, tapped on one of their profiles and tapped on the share option on one of their tweets. My fear is that this action will be logged in my device as something like "attempted to share <twitter username>'s tweet" and as a result the attack vector will be in my system. But reviewing the facts, I don't have anything to worry about right? I've been losing sleep over this. | |
| Dec 12, 2021 at 11:36 | comment | added | Robert | As far as I know Android does not support JNDI which is a requirement for the attack. No JNDI no attack. | |
| Dec 12, 2021 at 11:34 | comment | added | mistes | @Robert I don't know which Java editors, I don't know much at all about java. I was just confused because people were saying "Android doesn't support JNDI" so I was unsure as to if they were referring to any java editor or just the native android logging. so, in short, android is safe? Even if android logs a log4j attack vector/code, there will be no effect? | |
| Dec 12, 2021 at 11:18 | comment | added | Robert | What "Java editors" are you talking about? Android native logging does not support message formatting at all (that is how the vulnerability can be triggered in log4j2) therefore it is safe to use. | |
| S Dec 12, 2021 at 8:35 | review | First questions | |||
| Dec 12, 2021 at 13:04 | |||||
| S Dec 12, 2021 at 8:35 | history | asked | mistes | CC BY-SA 4.0 |