Daily Tech News 13 December 2021

• Hmm. Remarkably little news today. Nothing new has exploded and ruined the lives of sysadmins around the globe. I think everyone is sleeping off the chaos of last week.
  
  I wish I was.
  
  
  
• Looks like that Log4j vulnerability first surfaced on December 1, a full week before anyone noticed. (ZDNet)
  
  The idiot script kiddies using every server they can breach to mine crypto actually serve a useful purpose, in the same way that... 404 Analogy not found. In the same way that Billy the mailboy showing up to work with a thousand bucks worth of bling alerts you to audit your system before Svetlana from accounts payable disappears with a couple of mill.
  
  
  

• Little JNDI Tables.
  
  

  A story in three parts 😶 #log4j pic.twitter.com/XMl02BcaJY

  — Cas van Cooten (@chvancooten) December 10, 2021

  
  
  A researcher hacked Apple - just a little bit - simply by changing the name of his iOS device. The logs show that Apple's servers dialed out to his research server when his connection was logged, which would have let him run arbitrary code within Apple's datacenter.
  
  That's how bad this was. That's how easy it was to exploit. And it was everywhere.
  
  It could be that Apple's logging servers are isolated and can't do anything, but they're not as isolated as Cloudflare's, which were configured so they couldn't dial out at all.
  
  
  
• On the upside, there's this.
  
  

  so fixing log4shell is great and all, but.. wouldn't it be ✨ amazing ✨ if we all just promised to be nice and instead use this power to make vanilla minecraft doom server 🤔 pic.twitter.com/tCaUCG1dqg

  — Gegy (@gegy1000) December 11, 2021

  
  
  Someone exploited a bug in a logging library to make a Minecraft server run Doom.
  
  
  
• New keyboard arrived. Accidental jellybeans too. Desktop shelving is now due next Monday rather than today, but whatever. The second Dell laptop is now stuck in between "shipped" and "on its way" - I think systems bound for Australia are assembled in Singapore, so there's a period where they go into stealth mode where they've been shipped from the factory but tracking just doesn't update.
  
  Won't have time to do anything with it this week anyway.

posted by Pixy Misa at 03:07 AM

| Access Comments