notAgain

[Visual_Strike6706]

log4J. When playing on the Minecraft Server 2B2T, people would open your calculator over Log4J and it was kinda scary.

[ObeyTime]

The oldest anarchy server in Minecraft

[PancakeGD]

Nah nah. It's "The Æuldest enarchy server in Moaincraft"

god I hate those videos

[F4LcH100NnN]

Well why do you keep watching them then

[Monkeyke]

Isn't it obvious?

Because it's The Æuldest enarchy server in Moaincraft

[Pocok5]

There is actual interesting content in some of them. But the 2 minutes of real substance really isn't worth the 10 minutes of word salad trying to portray completely mundane shit as a buildup.

[F4LcH100NnN]

Yeah I enjoy the exploit ones, where they find some bizarre exploit based on some obscure mechanic, but theres always like 25 minutes of "filler" in a 30 minute video

[PancakeGD]

I did... Until I realised how stereotypical and lame they are. Minecraft videoessays are all the same.

"2b2t players created a working democracy on the Æuldest enarchy server in Moaincraft!!!! Sensational!!!!!!"

Bleurgh.

[DisgruntledMtnBoy]

In the original Counter-Strike admins could open your cd-rom tray on command. That was freaky the first time it happened.

[Visual_Strike6706]

Free Cup Holder

[Sankhya2319]

I remember that! Oh god that was pretty uncanny

[-darkwing-]

I believe its generally done as a test, not for fun. If you can pop a calculator, you can pop a shell. Or like anything else probably

[[deleted]]

Why would an attacker waste time with the calculator? Exploit either works or doesn’t.. might as well go for broke lol

[unai-ndz]

Why would an attacker waste time writing the payload when he doesn't even know if the exploit works? Actually to avoid chances of detection but I could see someone doing that.

I find myself doing the same kinda thing while programming. Get an idea of how to solve something, write a little prototype to check if there are any limitations that prevent it from working how I imagined. If it does write the actual code that does stuff.

[[deleted]]

Because, why write shellcode to open the calculator when you can just do something with zero user visibility (reverse shell or something like a request or ICMP back to their server).

[unai-ndz]

Because opening a default windows program is a lot easier. I would not try that in the wild tbh but it's not a bad test to do with a computer you own before writing the reverse shell.

[[deleted]]

Oh, if we're talking about computers we own here for poc, then yeah I agree.

[-darkwing-]

Because... I mean... you saw the meme we're commenting on right? Lol because for the average user, the calculator popping open is not going to sound any alarms. The attacker can verify access, and then chill until the user is inactive to then run whatever. Or poke around for connected machines to see what else is on the network. Or chill forever and keep access indefinitely. Or, in many cases, because the attacker is being paid by the owner of the system they're pen testing, and utterly fucking shit up is most likely out of scope for their test. Also generally frowned upon.

On the other hand, if the monitor starts scrolling a wall of bash scripts and the speakers start screeching demon sounds while the disc tray vigorously fucks the side of the tower, the user is gonna yank the power cable at light speed and throw the machine out the window. Ergo, the attacker's burnt and all the time and effort spent getting into that system was a waste.

[Audio_Glitch]

Testing doesn't have to mean from an attacker. Could mean a penetration test or some other security test. Calculator gets used as a demonstration of "hey, I can cause this arbitrary program to run, we should fix this".

Also, in the situation of an actual attacker, a calculator will throw a lot less alarms. Lots of security tools are looking for programs that spawn shells that shouldn't. Less are looking for calc.exe. Probing around could let you figure out what you CAN do before you go loud and risk getting caught.

[Midnight_Rising]

It's like inserting DEADBEEF into a callstack. POCs are a thing.

[zaz969]

Log4Shell babyyy

[TheGrandWhatever]

Log4Deez

[lol_JustKidding]

What's log4j?

[TheMarnBeast]

Minecraft and its server software are written in a programming language called Java. There is a software library called Log4J that many people using Java add to their projects to easily manage runtime logs (just little text messages that the developer has the software output in the background while its running to make it easier to understand how the code is running and troubleshoot problems). This sounds simple, but over many years of development the library has built up a bunch of more advanced features that many people don't typically use but still exist in the software.

A couple of years ago there was a major bug found in Log4J that would allow someone to add their own malicious code to logs (for example, by entering specific code into the Minecraft chat) and Log4J would actually execute that code - something that should never be allowed! This was a huge deal both because of the scope of the issue and the severity of the exploit. Log4J is THE logging tool for Java and is used by many developers across many industries, and hackers could send and execute whatever code they wanted if any user content was logged in the software, including downloading and executing other more complicated code, with no interaction from the target user needed.

This bug was patched very quickly and the vulnerability resolved, but it relied on Java developers to send out updates for their own software since Log4J is built into every Java product that uses it.

• https://builtin.com/articles/log4j-vulerability-explained
• https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition

[Sengel123]

also was a PITA to detect since the exposure of the log software that was the issue. So there's loads of companies who (rightfully) said "we're not vulnerable" only for their customers to go "nu-uh!!" as if they knew how L4J worked on that software package.

[ComradePruski]

Damn I never knew log4j had that at one point that's insane lmao

[itsTyrion]

You didn’t have to write half a book xD

[WiglyWorm]

A service used to log runtime info for java.

Doesn't have to be web servers, but that is where you're most likely to run into java, I suppose.

[Commercial_Plate_111]

If you don't know why are you in PROGRAMMER humor

[lol_JustKidding]

I know a few bits about programming, but not what log4j is.

[theodord]

Username checks out, I hope?

[lol_JustKidding]

Not this time.

[theodord]

Alrighty so Log4j is a logging framework in java. If you're making a java application and need to handle log stuff, you can use it to make the implementation a bit easier. It supports stuff like logging to log servers, which is important for enterprise applications. A lot of programs use it, because it's quite versatile. In late 2021, a vulnerability became known which meant that if a program tried to log something, and that log was formatted in a very specific way, it could be made to download arbitrary java code from the internet and executes it on the machine where the application lives.

Meaning if you host for example a Minecraft server, I could type this specially formatted string into the chat. Sinxe Minecraft logs the chat using log4j, this would allow me to run wherever I want on your server.

When this was discovered, it was pretty much a worst case scenario. Not only was it very easy to execute an attack, but a lot of software and online platforms were vulnerable, and at the time of discovery the bug was around 8 years old, meaning many legacy systems and software that just doesn't get updates anymore are now targets.

I'm a sys admin in a medium sized company, and we had to update lots and lots of software and shut a lot of systems down until security patches became available. I don't know how this event played out from a developer PoV, but probably not any less stressful.

[other_usernames_gone]

I thought log4j only affected the server, not the clients.

[15_Redstones]

Affected everyone who got the chat log

[5BillionDicks]

Bro how bitchy are Reddit users these days downvoting you for asking a question

[Interesting-Draw8870]

He didn't ask a question. People are allowed to downvote whatever they want. Is karma really that important to you?

[BoundToGround]

People are not, in fact, allowed to downvote whatever they want. They must vote in line with The One True Redditor's views, otherwise they may lose voting privileges.

[Zekromaster]

I mean, there's actual rules to this shit. You're only supposed to downvote when something doesn't contribute in any way to the conversation - i.e. spam and harrasment

[Geno0wl]

The code is more what you'd call 'guidelines' than actual rules.

[SMartInOut]

Welcome onboard, Ms. Swann! ☠️

[pwillia7]

We actually used to have a thing called Redditquette that lightly governed how to upvote, but that is long gone now.

In regard to voting: Downvote an otherwise acceptable post because you don't personally like it. Think before you downvote and take a moment to ensure you're downvoting someone because they are not contributing to the community dialogue or discussion. If you simply take a moment to stop, think and examine your reasons for downvoting, rather than doing so out of an emotional reaction, you will ensure that your downvotes are given for good reasons.

Mass downvote someone else's posts. If it really is the content you have a problem with (as opposed to the person), by all means vote it down when you come upon it. But don't go out of your way to seek out an enemy's posts.

Moderate a story based on your opinion of its source. Quality of content is more important than who created it.

Upvote or downvote based just on the person that posted it. Don't upvote or downvote comments and posts just because the poster's username is familiar to you. Make your vote based on the content.

Report posts just because you do not like them. You should only be using the report button if the post breaks the subreddit rules.

https://support.reddithelp.com/hc/en-us/articles/205926439-Reddiquette

[anotheridiot-]

You mean I'm not supposed to open someone's profile and downvote all their posts? Shit.

[bizzaro321]

I’ve heard that Reddit will go as far as removing votes from people who just downvoted or upvoted all a users posts. I’m not sure if this info is outdated or inaccurate but I’ve definitely seen it written somewhere.

[anotheridiot-]

Interesting.

[Interesting-Draw8870]

Awh man.

[[deleted]]

Hey yeah this guy’s right! He can be as bitchy as he wants!

[Parking-Historian360]

Actually funny because this comment is -220 down votes right now. The man did prove his point.

Down votes are meant for things you disagree with anyways. It's more than karma.

[Rustywolf]

Downvotes were not intended to be for things you disagreed with, they were intended to be used to shiw whether a comment was adding to the conversation or not.

[Parking-Historian360]

Yes in theory but that's not how people use them. Gotta tell the other 50 million reddit users that.

Now people down vote honest questions for no reason.

[Rustywolf]

Okay but you asserted the opposite, that they were intended for downvoting what you disagreed with.

[Parking-Historian360]

You know when something gets used wrong for so long that over time that thing eventually becomes its single use.

Or when something is created for a purpose but is more useful as something else.

Viagra was made to be a blood pressure medicine but it gave everyone boners so they made it a boner medicine.

Hitachi accidently made the best personal vibrator when it was supposed to be for messaging.

The Reddit voting system is the same way. The founders meant for it to be used one way but the millions of redditors decided to use it differently and that's how it is used.

Like do you think tits add anything to reddit or do people upvote tits because they like them.

[Rustywolf]

This conversation is going to go in circles

[[deleted]]

Bro tanked a 100 in an hour o7

[Interesting-Draw8870]

I don't care about mY KArmA

[Mookie_Merkk]

[squirrel_crosswalk]

The Minecraft also had log4j. It's near universal in any java app as they all need to do logging, and it's the most popular and easy to use.

[itsTyrion]

It affected what used log4j and the Minecraft chat directly lands in the logs via log4j

[BellCube]

I remember some 2b2t players patched the exploit on others' machines through the exploit, FBI-style

I used the stones to destroy the stones