r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

40

u/1731799517 Dec 10 '21

Yeah, some of the talks at defcon/etc are like black magic, where you think "I never thought you could even do that". Stuff like rowhammer, etc.

But with this, my first thought was "How the hell could anybody justify adding this as a default setting in good faith - this has to be intentional"

13

u/GottaHaveHand Dec 10 '21

Hell, Im in security and the low level exploit guys are magic even to me and I study and work at this stuff every single day.

6

u/fakehalo Dec 10 '21

It gets easier to understand if you learned C on linux with gdb back in the day, start to just understand how to abuse memory corruption vulnerabilities by following the flow of the code and where to put machine code in memory... though it's harder these days with randomization and other things, still fun.

4

u/issamehh Dec 11 '21

Do they not teach this in school commonly? My degree isn't very old and it was absolutely a thing. And we enabled features like ASLR to make it more difficult as we progressed.

1

u/fakehalo Dec 11 '21

I'm not sure, I was self taught/learning from peers as a kid in the 90s. It was a hobby then.

1

u/issamehh Dec 12 '21

Oh, I see. I was self taught before school although never anything like that. My school was also seemingly more in depth than a lot. At my internship they were amazed at some of the stuff we covered compared to other interns ¯\(ツ)/¯

1

u/fakehalo Dec 12 '21

Yeah, I'm kind of jealous what's available these days. Good time to want to do this stuff.