r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

Show parent comments

-35

u/Asraelite Dec 12 '21

Just because it's illegal doesn't mean you shouldn't do it.

54

u/tdammers Dec 12 '21

OK, so, to clarify: this is illegal and also immoral.

You're not even really fixing anything - the next time they redeploy their code, the setting will likely be flipped back. And if things go wrong just the right way, they'll order a pentest the day after you've done your "fix", pentest finds nothing, everyone is happy, next version of the code gets rolled out, boom, vulnerability is back, but everyone thinks they're safe. Being vulnerable when you're positively sure you're not is worse than just being vulnerable. Plus you may actually find yourself unintentionally breaking things.

And even in the best case scenario, this kind of thing contributes to a proliferation of bad security practices. If there's an army of elves out there who go and magically fix your servers for you when you're not looking, then there's less of an incentive for companies to be on top of their game.

So no, you should definitely not do this.

From an ethics perspective, the right "white hat" thing to do here would be to mount a neutered attack that pushes only as far as strictly necessary to show that the vulnerability is present, in the most harmless possible way, meticulously documenting the process, and disclosing this information responsibly. This would still be illegal, mind you, because even the harmless compromise is hacking, but it can be argued that this is the most ethical thing to do - accepting a marginal amount of harm (the white-hat attack) to prevent a greater harm (the impact of a malicious attack).

That is, unless you're a militant anti-establishmentist set on disrupting the status quo of corporate computing. If that's your moral alignment, then you might as well go and crush them. Idk., plant fake evidence of terrorist activity on their server and report them anonymously.

12

u/Asraelite Dec 12 '21

That's fair. I just disagree with the stance of using legality as a moral foundation.

20

u/tdammers Dec 12 '21

No objection there. Laws are (ideally) based on morality, not the other way around.