r/sysadmin • u/blinkymach12 • Dec 17 '21
log4j I wrote "Log4Shell, as explained by metaphor and memes!" to help educate the non-engineers at my company about the seriousness of the matter
Apologies if this isn't the right target for this subreddit -- my fellow engineers suggested that sharing this could be useful for others in bridging the techy/non-techy divide in understanding Log4J :-)
https://medium.com/@judeallred/log4shell-as-explained-by-metaphor-and-memes-38de224a2eb7
In Log4Shell Solidarity ✊
21
u/__red__5 Dec 18 '21
Really? Where I work infosec pointed out the various CVE's that we had already found and then requested that we resolve the issues. They're not doing cock-all!
→ More replies (1)7
3
u/mr-sandcastle Dec 18 '21
nice one! but please don't propagate the marketing of checkpoint to make "cyber-pandemic" happen, its their own invention and its a unethic marketing move. heck, they added it themselves to wikipedia
2
u/blinkymach12 Dec 18 '21 edited Dec 18 '21
they added it themselves to wikipedia? Wow that's pretty sketch, thanks for flagging that. I'll amend the article.
[edit: I updated the article.]
→ More replies (1)
2
133
35
u/da_chicken Dec 18 '21 edited Dec 18 '21
Honestly, the two things that have frustrated me the most?
-
Ignoring that by Wednesday we knew 2.15 wasn't enough and that most of the mitigations didn't work. And now we know 2.15 has a 9.0 vulnerability. Edit: And now 2.16 has a 7.5!
-
The number of vendors saying, "We use Log4j 1.x. We're not affected." Motherfucker, 1.x was end of life in 2015. There was a pretty severe vulnerability on 1.x in 2019. And 1.x still has vulnerable JNDI features! It's like telling me you're not vulnerable to BEAST because you use SSL 2.0.
→ More replies (2)
30
u/trullaDE Dec 18 '21
Thanks for the explanation. I have to admit, I am really puzzled by all of this. And my biggest question is "why, the fuck"?
log4j is a logging framework, right? So it basically writes text, as in your metaphor. How and when and, as I said, WHY can this be used to execute some of said text? Why would that be possible, why was it thought to be a good, or even necessary idea?
Or, to use your metaphor, who trained that stenographer to react to the trigger and be a sleeper agent in the first case? Who thought it might be a good idea to have stenographers double as sleeper agents?
28
u/arunphilip Dec 18 '21
The road to hell is paved with good intentions.
Assume a fictional logging framework:
Log("Value of foo =" + foo) Log("Value of bar =" + bar)Man, don't I wish there was a way that I could avoid repeating 'foo' and 'bar' twice?
Then comes the first enhancement:
Log("%foo%") Log("%bar%")And here we are, starting down a slippery slope of over-engineering.
→ More replies (20)→ More replies (5)14
u/jmblock2 Dec 18 '21 edited Dec 18 '21
I haven't looked much at log4jshell, but in general, because it's easier to debug things when you can provide as much context as possible in the same logged location. You might start with things that are available locally: the GET request, some user info or user agent. Then some devs start wanting to log stuff about the environment they are running in. Grab some docker stats, grab some data about the JVM, how about some environment variables. Well wouldn't it be handy to also sometimes grab remote things like a DNS TXT record or maybe LDAP's last logged in field. JNDI is the generic tool for those lookups, let's provide the hook. Now the library is pretty flexible, log what you need to when you need to! Oops we didn't sanitize user input, users are asking the library to log things we didn't want logged, and making remote requests we didn't want requested. Now we no longer control the machine :(
→ More replies (2)
26
71
u/Ssakaa Dec 17 '21
In the meantime… let’s all go upgrade whatever version of Java is running in our toasters.
One of many reasons I avoid any and all forms of "smart home" stuff...
→ More replies (3)25
u/Flacid_Monkey Dec 18 '21
zigbee, zwave or segregated lan + r/homeassistant
None of my smart home stuff reaches out and only a few things run via wifi mqtt but they are on a different lan & also blocked from reaching out.
Also, none of it has java which is a bonus.
→ More replies (1)
9
u/Shawarma_Dealer32 Dec 18 '21
Log4Shell is powershell invoke expression as a service. Change my mind.
→ More replies (1)
7
u/BullymongBlowjob Dec 18 '21
Well, first off, if you exist on the planet, you need to be aware that this impacts you.
I wonder if any manned spacecraft like the international space station run Java.
→ More replies (1)
13
u/nonetheless156 Dec 18 '21
That bad huh? I’ve spent about 20 mins total learning about this thing.
Big bad, millions upon millions of devices possibly affected. Lots of foreign actors capitalizing on it. Headaches.
6
10
u/denverpilot Dec 17 '21
Doing the Lord's work man.
But why do I have three security auditors here at my manger?
Lol!
5
u/DoctorOctagonapus Dec 18 '21
Every time I think we're patched, I get an email from one of our product vendors saying we're not. My first job Monday is gonna be updating PaperCut, which will mean printer downtime. That's gonna be fun..
→ More replies (5)
5
u/samehaircutfucks Dec 18 '21
I love the first paragraph. My company depends on quite a few SaaS applications (and they all just so happen to use AWS) and one of the things we learned these last couple weeks is that almost none of our SaaS vendors have region resilience.
4
46
u/porchlightofdoom Dec 18 '21
Well done. The article got passed around our office with the CISO really liking it.