Log4j: Break Me Completely
summary
Examines the high-profile Log4j 2 vulnerabilities, demonstrating practical exploitation by hacking a Java service and explaining why the flaw threatens non-Java systems as well. Covers mitigation stories, why the bug is especially dangerous, and how it has brought SQL-injection–style risks back into relevance.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:10What is Log4j 2
- 6:46JNDI and Lookup mechanism
- 9:55RMI exploitation
- 12:24RMI attack demo
- 17:17LDAP exploitation
- 21:44LDAP attack demo
- 25:46JNDI and Tomcat exploitation
- 30:48Tomcat attack demo
- 31:51Nested interpolations in Log4j
- 33:59Protection attempts and limits
- 35:01MDC protection check
- 39:50Fixing the vulnerability
- 41:58Log4j vulnerability timeline
- 44:25Elasticsearch vulnerability
- 46:11Vulnerability prevalence
- 48:00Log4j usage risks
- 52:18Enterprise protection discussion
- 55:50Conclusion and advice
related talks
17mLog4j - A Placement Student's Baptism by Fire
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
40mWhat Log4j taught me
49mThe Anatomy of Java Vulnerabilities
56mThe Anatomy of Java Vulnerabilities
58mWhat the log4j incident taught us about Secure by Design
51mLog4Shell Armageddon or Opportunity
51mDouble plus Ungood Why Log4Shell Is So Bad