#supply-chain

Posts tagged #supply-chain

1. Article

   Log4Shell, four years later: the lesson everyone said they learned and nobody did

   Log4Shell (CVE-2021-44228, December 2021) is old news, but I keep seeing the same mistakes it should have cured, so here is the short version and what it was actually about. what happened Log4j is a Java logging library that is inside an enormous amount of the world's software. it had a feature where a logged string could trigger a lookup, and an attacker who could get a crafted string logged (a username, a user…

   Nadia BenaliSep 10, 202640likes6comments

2. Article

   the XZ backdoor was not a hack. it was a hostile takeover of a tired volunteer.

   everyone remembers the XZ backdoor (CVE-2024-3094, March 2024) as "the thing that almost backdoored SSH on every Linux box". that part is true and it was caught by luck, a Microsoft engineer noticing a half second of latency. but if you only remember the clever technical part you learned the wrong lesson. here is the short technical shape of it, and this Seytonic video does the timeline well if you want the full…

   Karl LindqvistJul 16, 202640likes7comments