Log4J & JNDI Exploit: Why So Bad? - Computerphile
Source: YouTube · Computerphile · published Dec 22, 2021 · 26:33
The video discusses a serious security vulnerability in Log4j, a Java logging library, which has significant implications for internet-connected software 0:06.
Key Takeaways:
• A recent exploit/bug in Log4j2 has emerged that poses security risks 0:06
• Log4j is a Java package that enables developers to log events in their applications 0:29
• Half of the vulnerability is actually in JNDI, another component of Java 0:37
• Logging is critical for tracking data flow in internet-connected applications 0:49
The vulnerability highlights how even fundamental components like logging libraries can introduce significant security risks.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
thank you for joining me and uh yeah we have a yuletide feast is it a your log what is it what's going on in the world of uh log files so there's been a an interesting i mean exploit maybe bug feature pick your appropriate um sort of word to describe it that's appeared in the last few weeks pick your own word to describe it in a package called log for j2 which is a thing that michael talked about a bit that adds on to java that enables you to log things actually that's that's a little unfair because half the problem isn't in log4j it's actually in another part of java called jndi but we'll come to that let's let's start at the beginning as it were so are you sitting comfortably then i'll begin when you're writing software particularly software that communicates over the internet whether th…