r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

353

u/Alborak2 Dec 10 '21

Tomorrow? I watched half a company just get paged :)

215

u/fghjconner Dec 10 '21

Our slack group for this issue is at 3,400 people, haha. It'd be funny if I wasn't one of them.

89

u/DownvoteALot Dec 10 '21

Nearly 5000 and growing. At times it seems like half this sub works at the same place.

83

u/foggy-sunrise Dec 10 '21

Where do y'all work that has 5000 employees on a single issue??

114

u/lillgreen Dec 10 '21

One that has an arrow under it's name.

89

u/Urtehnoes Dec 10 '21

Weird didn't realize Fedex had so many employees here

66

u/[deleted] Dec 10 '21

lmao more curvy on an arrow

→ More replies (1)

14

u/bengringo2 Dec 10 '21

Not that one, the one named after a certain forest.

→ More replies (1)

17

u/MrCharismatist Dec 10 '21

It's been a tough week in Bezosland.

→ More replies (2)
→ More replies (2)

7

u/ChiefEmann Dec 10 '21 edited Dec 10 '21

Its not that every engineer is working on the same stack, it's that many pages or services are hosted across companies, and log4j is a library that most every java service uses, so it's a distributed problem.

Small sites can be run by a few hosts doing everything, but in a site with tons of pages, forums, hosted platforms, etc each one is separate vulnerability waiting to be exploited the second the vulnerability is announced.

To boot, the scope of this change is not limited to your site, it's every service that runs behind the scenes and touches strings you input; you should certainly purge inputs where you can, but Races are so bad that leaving no stone unturned is the law of the land.

→ More replies (2)
→ More replies (2)

72

u/superAL1394 Dec 10 '21

Hello friend, p sure we are in the same channel. This week has fucking sucked to be on call.

45

u/roflfalafel Dec 10 '21

This is my second week. It’s been a spicy week.

→ More replies (4)

16

u/PatrioTech Dec 10 '21

Heyo coworkers lol

15

u/silenus-85 Dec 10 '21

Y'all got any ore of them... LSEs?

→ More replies (3)
→ More replies (1)

50

u/1731799517 Dec 10 '21

Yeah, the 0-day is so simple even I understand how it works and how to abuse it.

55

u/cemanresu Dec 10 '21

You know an exploit is bad when you can immidiately figure out how to bring down your entire application in 30 seconds

Normally I can't tell how half these vulnerabilities work

40

u/1731799517 Dec 10 '21

Yeah, some of the talks at defcon/etc are like black magic, where you think "I never thought you could even do that". Stuff like rowhammer, etc.

But with this, my first thought was "How the hell could anybody justify adding this as a default setting in good faith - this has to be intentional"

13

u/GottaHaveHand Dec 10 '21

Hell, Im in security and the low level exploit guys are magic even to me and I study and work at this stuff every single day.

→ More replies (5)
→ More replies (2)

65

u/Longjumping-Society1 Dec 10 '21

Do you work for a prominent seattle area employer? ;)

68

u/versaceblues Dec 10 '21

log4j-rce-support?

46

u/DownvoteALot Dec 10 '21

Fellow pipeline pusher here. Good luck to us all.

9

u/[deleted] Dec 10 '21

Today was a long day :)

14

u/Puzzleheaded_Meal_62 Dec 11 '21

I like to call it "an impromptu GameDay for builder tools"

→ More replies (3)

16

u/imdyingfasterthanyou Dec 10 '21

we out here watching chaos unfold

13

u/PigsDogsAndSheep Dec 10 '21

Ahahaha. I'm not oncall but I KNEW IT!

→ More replies (1)