Log4j - A Placement Student's Baptism by Fire
summary
A placement year at a major car company in December 2021 exposes how a single JNDI lookup string in Log4j yields remote code execution (Log4Shell), with exploits seen on roughly 40% of corporate networks in early scans. Corporate response creates a 20+ person task force with two‑hour daily meetings, hourly vulnerability scans, and Citrix VDIs that get VDIs wiped, leaving developers offline for about two weeks; lack of dependency tracking and a stubborn gold‑image log4j.jar cause most of the disruption.
AI-written summary · about
chapters (6)
- 0:00Introduction and context
- 1:16Understanding the vulnerability
- 2:43Technical mechanics of Log4Shell
- 6:15The corporate panic
- 7:13The task force failures
- 10:30Lessons and reflections
related talks
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
51mLog4Shell Armageddon or Opportunity
51mDouble plus Ungood Why Log4Shell Is So Bad
58mWhat the log4j incident taught us about Secure by Design
07mLog4j Hygiene
59mLog4j: Break Me Completely
46mThe Next Log4jshell?! Preparing for CVEs with eBPF!
02h 38mJava application security the hard way - a workshop for the serious developer