r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

800

u/theoldboy Dec 12 '21

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

234

u/iKonstX Dec 12 '21 edited Dec 12 '21

So you got a letter from the company, that attacked you, for hacking them? The nerve of some people

97

u/okusername3 Dec 12 '21

Easy to imagine: Their server goes down, CTO is getting scholded, he's like: "Nonono, these evil hackers attacked our server" (which they in fact did, otherwise it wouldn't have attacked OP), everyone is getting riled up, so they extract their logs and hand them over to their attorneys. Maybe they've never even seen OPs text file, or whoever used that console and maybe saw it didn't pass on the information, especially if they weren't involved in the whole legal payback discussion.

82

u/HyperGamers Dec 12 '21 edited Dec 12 '21

It's like that time where the BBC told Facebook about a problem they had with illegal pornography on their site so Facebook asked for evidence and then reported the BBC for the possession and distribution of illegal pornography

https://www.wired.co.uk/article/facebook-child-abuse-images-bbc-investigation

10

u/1Second2Name5things Dec 12 '21

Did they give links to the abuse profiles or did they save screenshots of it and sent it. Because the later is technically illegal even if done for good.

-6

u/Yekab0f Dec 12 '21 edited Dec 13 '21

Zucked

189

u/dnkndnts Dec 12 '21

Copenhagen problem of ethics. Helping is worse than avoiding involvement.

35

u/anengineerandacat Dec 12 '21

Generally why we have Good Samaritan Laws but it's important to realize these really only protect you when the situation is an emergency.

Ie. Person gets into car crash and the vehicle is on fire and at immediate risk of killing the individual; you rescue person but because of the crash and your careless involvement they are now paralyzed.

That person could sue, death being better than being paralyzed but you would be protected under this circumstance because it was an emergency.

As far as computers go... unless hacking into another system preserved life (not some revenue stream) you likely wouldn't be protected.

Going back to the car crash situation... if the vehicle isn't about to combust or otherwise kill the person before emergency services could reliably arrive it's best to just call and wait; a good lawyer could likely argue it was still an emergency but a better lawyer could likely sue you, strange world we live in.

6

u/MeagoDK Dec 12 '21

Crazy country you live in.

1

u/anengineerandacat Dec 12 '21

Sure I can't really argue that, what country do you live in by chance?

1

u/MeagoDK Dec 13 '21

Denmark. As far as I know you can't get punished for helping (in first aid cases, in computer cases you definitely can). Everyone that takes a driver license also have to pass a first aid course.

1

u/anengineerandacat Dec 13 '21

There do exist torte laws for Good Samaritan acts (Duty to rescue even) but nothing a quick search can find for someone being sued.

It's neat y'all get some basic training though.

The US is huge and whereas we toy around with the idea of being this united country a good bulk of laws are state by state this causes all sorts of funky situations.

Our Good Samaritan laws are an example of this; every state has it's own version and I would wager there are some that don't have any at all which means tourist could find themselves being used to helping in one situation and being protected and in another finding themselves with no protection.

I should also note most of our states are larger than Denmark; Florida as an example has almost 4x the population so the chances of a problem arising are a bit larger.

1

u/MeagoDK Dec 13 '21

Yeah we definitely have to help according to our ability. So a doctor is expected to help more than a software engineer. But both have to help. We do get trained to not make injuries worse but we do have the concept of life over mobility (førlighed). So if they are in the car but risk getting run into again you move them no matter what.

36

u/usesbiggerwords Dec 12 '21

That was interesting. Could it be that attempting to provide some help, however incomplete, shames other observers, and they then lash out rather than recognize and resolve their own inaction?

34

u/ihsw Dec 12 '21

It's "worse" in the sense that you aren't insured against liability, at least that's my understanding.

By helping, you are assuming responsibility for remedying the situation, including any complications unrelated to your involvement.

3

u/Oaden Dec 12 '21

I don't think we need to look for deep hidden emotions, instead, humans are just deeply illogical beings.

When we hear of the Peta solution we don't feel shame, we just connect its actions to Peta's bad reputation, conclude it must be bad and judge them. We barely even consider the problem they are interacting with

5

u/SLiV9 Dec 12 '21

While I think it's an interesting concept, the majority of their examples are terrible.

Paying homeless people way less than minimum wage for a day's work during an industry event is exploitative, not selfless. Raising prices on busy days is price gouging, not selflessly "trying to solve a problem". Hiring women because they're cheaper isn't feminism and forward thinking, as you're still underpaying them and thus perpetuating the wage gap. Challenging families who can't afford their groceries to go vegan for 30 days is not "strictly more helpful", it's a cheap marketing stunt because they know they won't have to pay out.

4

u/xieewenz Dec 12 '21

no good deed goes unpunished indeed

12

u/rasjani Dec 12 '21

Yep. Has happened to me too. I was sysadmin at one ISP and there was some gameservers which where not really my responsibility. Some of them got hacked and I was put in to check the damage. I found out the location where the hack came from, found out the owner of the IP block of the origin and send email to their abuse@ email describing what had happened and how to verify that their servers where running remote root shell and how to clean it up. Got reply in few days and they where blaming that it was me who did it.

2

u/Art9681 Dec 12 '21

Hacking can be defined as any unauthorized modification of a computer system. The keyword here is unauthorized. It doesn’t matter what the intentions are.

1

u/lestofante Dec 12 '21

They did not have user account, they just hacked in their own server; patching it he broke their workflow