andrewducker | Interesting Links for 16-12-2021

Crossposts: https://andrewducker.livejournal.com/4125340.html

Entry tags:

I shall attempt to explain. Apologies if I fail!

Log4j is a free library of code designed to be used by other applications to provide logging functionality (where "log" means "make a note of", not "chop down trees"). It's been around for 20-odd years and is used in an awful lot of applications, as it became somewhat of a standard library that everyone who needed to log information used.

When it was first created, there was a lot less worry about security, and a bunch of functionality was included to allow it to do very powerful things, without thinking "How would a determined hacker make use of this?"

And then, a week ago, someone worked out a really easy way to make it do *anything*, from a remote computer, effectively allowing them to take over the computer it was running on.

As it is a code library, and thus included inside other applications, lots of companies are now desperately scanning all of their computers to see if they have anything that uses it - and finding it in everything from software they have bought in to things that were written internally up to 20 years ago and haven't been touched since. All of these need to be fixed, and there might be hundreds of them across a larger company.

Flat | Top-Level Comments Only

Interesting Links for 16-12-2021

no subject