3 ms·

to the best of my knowledge it was discovered via a minecraft exploit and I don't think minecraft players are generally the "responsible disclosure" kinda peopl

to the best of my knowledge it was discovered via a minecraft exploit and I don't think minecraft players are generally the "responsible disclosure" kinda people.

dogma1138 5y ago
TBH it’s also quite mind boggling that this level of an RCE was used to hack Minecraft servers of all things. I wonder if this wasn’t intended for something bigger and they just got caught when testing this out in the field.
- enkid 5y ago
  Or they didn't know what they had. People spend a surprising large amount of time trying to cheat at video games. They could have stumbled onto it in this context without realizing the much larger picture.
- shagie 5y ago
  Minecraft servers were one part of it... Minecraft clients where another. If you sent a message to everyone with a client (that logged that message), everyone with a client would at least ping back to the ldap server. The issue where this was introduced was: https://issues.apache.org/jira/browse/LOG4J2-313 https://issues.apache.org/jira/browse/LOG4J2-313 That's from 2013 (Minecraft was 2 years old then) On the other hand, nothing with it really happened until someone asked if it was a security vulnerability - https://github.com/apache/logging-log4j2/pull/608#issuecomment-989762094 https://github.com/apache/logging-log4j2/pull/608#issuecomme... And then all hell broke loose. Simply said, this was a feature that was intended to make it easier for one company to use their structure with ldap lookups for where/how to log. The author of the change did what many people encourage others to do when working with open source "here's some code that I wrote, I'm contributing it back upstream." If this was part of something "bigger", it sat quiet for the better part of a decade.
  - cannabis_sam 5y ago
    Wow, that’s a scary read… No consideration, no discussion, no security analysis, just “JDNI is cool, can I hav plz? Ofc!” Did none of these people consider what JDNI is designed to do? Did none of these people consider what side-effects are appropriate within a logging library?
    - shagie 5y ago
      Yes... but... realize that log4j2 was in beta releases at the time, being maintained by one developer as part of a "I want to redesign how it works". As an open source developer working on a project that hadn't even been formally released, I'd be quite pleased to have someone else contributing the features that they found useful back upstream in an effort to make it a better project. Yes, this is what jndi is supposed to do. Was it done as best as it could be? Probably not. But it isn't something that's only in log4j2 http://logback.qos.ch/manual/loggingSeparation.html#ContextJNDISelector http://logback.qos.ch/manual/loggingSeparation.html#ContextJ... https://dennis-xlc.gitbooks.io/the-logback-manual/content/en/chapter-3-configuration/configuration-file-syntax/variable-substitution.html#obtaining-variables-from-jndi https://dennis-xlc.gitbooks.io/the-logback-manual/content/en... But I'm not going to fault a solo developer of some beta software in the world of 2013 for not rejecting a patch because every angle wasn't thought out.
  - deleted 5y ago
    [deleted]
- weaksauce 5y ago
  yeah it's nuts. I wonder what the upper limit on a responsible disclosure bug bounty would have been(of course who would pay that is the question because it's an opensource project with a few maintainers) vs. the nation or underground price. This has been described as a once in a decade RCE.
- dumpsterdiver 5y ago
  Considering that Minecraft players have built functional computers in-game using redstone circuits, it's not surprising to me at all. Minecraft tends to attract folks who have an eye for detail, and a passion for figuring out how things work (a.k.a. hacking).
iJohnDoe 5y ago
A huge demographics play Minecraft. Kid of silly to make a generalization like that.

to the best of my knowledge it was discovered via a minecraft exploit and I don't think minecraft players are generally the "responsible disclosure" kinda people.

dogma1138 5y ago

TBH it’s also quite mind boggling that this level of an RCE was used to hack Minecraft servers of all things. I wonder if this wasn’t intended for something bigger and they just got caught when testing this out in the field.

enkid 5y ago
Or they didn't know what they had. People spend a surprising large amount of time trying to cheat at video games. They could have stumbled onto it in this context without realizing the much larger picture.
shagie 5y ago
Minecraft servers were one part of it... Minecraft clients where another. If you sent a message to everyone with a client (that logged that message), everyone with a client would at least ping back to the ldap server. The issue where this was introduced was: https://issues.apache.org/jira/browse/LOG4J2-313 https://issues.apache.org/jira/browse/LOG4J2-313 That's from 2013 (Minecraft was 2 years old then) On the other hand, nothing with it really happened until someone asked if it was a security vulnerability - https://github.com/apache/logging-log4j2/pull/608#issuecomment-989762094 https://github.com/apache/logging-log4j2/pull/608#issuecomme... And then all hell broke loose. Simply said, this was a feature that was intended to make it easier for one company to use their structure with ldap lookups for where/how to log. The author of the change did what many people encourage others to do when working with open source "here's some code that I wrote, I'm contributing it back upstream." If this was part of something "bigger", it sat quiet for the better part of a decade.
- cannabis_sam 5y ago
  Wow, that’s a scary read… No consideration, no discussion, no security analysis, just “JDNI is cool, can I hav plz? Ofc!” Did none of these people consider what JDNI is designed to do? Did none of these people consider what side-effects are appropriate within a logging library?
  - shagie 5y ago
    Yes... but... realize that log4j2 was in beta releases at the time, being maintained by one developer as part of a "I want to redesign how it works". As an open source developer working on a project that hadn't even been formally released, I'd be quite pleased to have someone else contributing the features that they found useful back upstream in an effort to make it a better project. Yes, this is what jndi is supposed to do. Was it done as best as it could be? Probably not. But it isn't something that's only in log4j2 http://logback.qos.ch/manual/loggingSeparation.html#ContextJNDISelector http://logback.qos.ch/manual/loggingSeparation.html#ContextJ... https://dennis-xlc.gitbooks.io/the-logback-manual/content/en/chapter-3-configuration/configuration-file-syntax/variable-substitution.html#obtaining-variables-from-jndi https://dennis-xlc.gitbooks.io/the-logback-manual/content/en... But I'm not going to fault a solo developer of some beta software in the world of 2013 for not rejecting a patch because every angle wasn't thought out.
- deleted 5y ago
  [deleted]
weaksauce 5y ago
yeah it's nuts. I wonder what the upper limit on a responsible disclosure bug bounty would have been(of course who would pay that is the question because it's an opensource project with a few maintainers) vs. the nation or underground price. This has been described as a once in a decade RCE.
dumpsterdiver 5y ago
Considering that Minecraft players have built functional computers in-game using redstone circuits, it's not surprising to me at all. Minecraft tends to attract folks who have an eye for detail, and a passion for figuring out how things work (a.k.a. hacking).

iJohnDoe 5y ago

A huge demographics play Minecraft. Kid of silly to make a generalization like that.