Rocha: Log4j exploit triggered remote code execution via logged HTTP strings
Dr. Eduardo Rocha · Data You Encrypted Today Can Destroy Your Life Within 10 Years · Jun 21, 2022 · at 23:58
Dr. Eduardo Rocha breaks down the mechanics of the Apache Log4j (Log4Shell) zero-day vulnerability for host Sean Weisbrot.
0:00 / 0:59exact quote · 59.9s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Well, it was an attack in which A specific string would be sent with HTTP requests that that then this would be logged by this logging mechanism called log for J. But in the background, that information could be properly processed and triggering some download of some remote code that could be then potentially Integrated in your application and then dumping information from your customers, right? So basically it's been called LogFoJ because it exploited that logging mechanism in LogFoJ and then it would trigger Yeah, these anomalous requests into a remote old app server that would then allow that, let's call it piece of malware or malicious code to download some remote code and then have it running in your cloud infrastructure and whatnot.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Dr. Eduardo Rocha
Rocha: 70-80% confident cybersecurity will adapt before quantum decrypts systems
“Somewhere between 70 and 80%.”
Rocha: Authentication will shift from accounts to identities within two years
“I think at some point in time, and this might be the year or the next year, we will migrate from accounts to identities, right?”
Rocha: Quantum computing could break current encryption within a decade
“Probably a decade or less.”
Rocha: Launching DDoS and Heavy Scraping Attacks Is Now Very Cheap
“Launching DDoS and heavy scraping attacks are now very cheap, you know”
Rocha: Pegasus spyware bypasses authentication to access all targeted phone data
“Well, it was some kind of spyware developed by some From out in the world that could basically access all the information in your phone, and they could also, assuming they would have your phone in hand, they could basically access all information by breaking a…”