Scourge · December 9 2021

The Great Scourge of Log4Shell

Chronicle

On 9 December 2021 an exploit was published for a flaw in Apache Log4j 2: getting a string like ${jndi:ldap://…} written into a log was enough to make the server fetch and run the attacker's code. Within hours, scanning and attacks began worldwide, from Minecraft servers to the enterprise products of dozens of vendors. CISA's director called it one of the most serious flaws she had ever seen. Weeks of back-to-back patches followed, along with desperate searches for the JAR file in the most unlikely places.

Lesson learned

It taught that a tiny library maintained by a few volunteers can hold up half the Internet, and made dependency inventories (SBOMs) and funding for critical open source popular.

Prayer of reparation

O Log4Shell, who came in through every text field and phoned home over LDAP, let our logs merely log, and let open-source volunteers at last have someone to pay them. Amen.

How it is remembered

Remembered by keeping an inventory of dependencies, transitive ones included, blocking outbound connections servers have no business making and supporting the open-source projects you rely on.