LOG4SHELL - A Zero Day you need to protect against TODAY

[@theycallmeken]

Farming turnips looks more attractive by day. Thanks for the vid 👨🏾‍💻

[@cybercdh]

haha, that's the dream.

[@thingyee1118]

Yup

[@kenbobcorn]

As always Colin, fantastic video and nice deep dive depth. I've got to say I don't understand most of the details, but it gives me a pretty good idea that I've got lots to learn. Looking forward to your next reverse engineering analysis video with tools just like old times :D

[@cybercdh]

Thanks man! Likewise I’m looking forward to more of your content which I always enjoy.

[@dunningkruger6075]

so if java is not installed on a system it's reasonable to assume the system is not vulnerable?

[@sliceronsteam]

A ton of services might pack in their own preferred version of java so it might not be as simple as making sure java is not installed system-wide.

[@TKomoski]

Thanks Colin Happy Holidays

[@cybercdh]

Likewise to you too.

[@mytechnotalent]

Thank you Colin. As always your analysis is most mature and extensive. Thank you for your breakdown and careful and brilliant analysis my friend! I am most concerned how embedded this threat is and how wide-spread it is. Apache is everywhere and RCE is such a serious threat. I wonder how long this zero-day has been known by Threat Actors? Nonetheless thank you and I am hoping everyone properly updates their infrastructure accordingly.

[@cybercdh]

Thanks Kevin, keep well and wishing you a peaceful Xmas.

[@mytechnotalent]

@@cybercdh You too!

[@maximilian19931]

Better mitigation is removal of Java and looking for other vendor Implementation(mostly runtime)

[@cybercdh]

It’s surprising how much Java is still very much under pinning so many platforms.

[@Mackenzieadventures1]

Java is still everywhere, especially if you support SAP.:)

[@joshallen128]

Openjdk

[@sliceronsteam]

So if your company has billions of dollars at stake and millions of lines of code running, just turn it all off and take a nap.

[@atol71]

Does Oracle use log4j for Java VM/JDK development and could the whole Java environment be compromised? Did they use Java tools (with log4j) for Oracle database development?

[@bowdej02]

Thanks Colin, great video!

[@cybercdh]

Cheers dude, hope you’re well.

[@tonysanderson7741]

Colin, seeing 2.22 as the version we have installed , slightly confused if that version is simply a misenturpreted 2.2 therfore < than 2.15 or actually later version than 2.15. is there any way of knowing?

[@haxguy0]

Thank you for breaking this down

[@angrybird29]

Thanks for this informative breakdown

[@cybercdh]

Glad it was helpful!

[@atol71]

The British NCSC directed to ask Oracle and NO ANSWER from USA equivalent....

[@0558tidyboy]

Thanks for great video !!

[@Nologogo]

thanks for the post. Very much appreciated.

[@ponderednamefordays6704]

Super interesting video! I'd love to see a breakdown of the NSO zero click imessage exploit. I read the google project zero blog post on it but can't wrap my head around the virtual CPU part.

[@cybercdh]

Yeh for sure, that exploit is from a different planet.

[@HackeXPlorer]

As always, informative and to the point , tHANkYou.

[@fireyonix]

thank you for breaking it down

[@ronaldinojikri5682]

Why don’t companies write their own logger instead of using these bloated pieces of $hit.

[@Krisztyan]

is log4j1 effected?

[@mattgoff3352]

No

[@rey82rey82]

Error

[@davejoseph5615]

Once again a stupid and unnecessary added "feature" creates a security nightmare.

[@bee6431]

i dislike

[@Corcontv]

...teeth...