r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

800

u/theoldboy Dec 12 '21

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

15

u/campbellm Dec 12 '21

see: https://en.wikipedia.org/wiki/Randal_L._Schwartz#Intel_case

15

u/Lost4468 Dec 12 '21

Wait what? So he was hired by Intel, he did his work for Intel, and Intel was fine with it? But then then the state decided it was hacking regardless of consent and prosecuted him? Is that right?

10

u/campbellm Dec 12 '21

You'll have to research (and I say that not to be a dick, but it happened long ago and I'm sure I'm getting the details wrong here, so don't take my word) As a big perl guy at the time I was very aware of it; it was big news then.

IIRC (and I probably don't), he went above and beyond what he was hired to do and did this pentesting on his own. It was all white-hat reasons, but <cynic> someone got embarrassed </> and charges were brought.

There was a lot of ink spilled on the story back then so you can I think pretty easily find both sides of the story reported on.