The Log4Shell zeroday 4 days on. What is it and how bad is it really?

If the max severity 0day hasn’t already dampened your xmas spirit it likely soon will.

The Log4Shell zeroday 4 days on. What is it and how bad is it really?

Enlarge (credit: Getty Images / Bill Hinton)

Log4Shell is the name given to a critical zeroday vulnerability that surfaced on Thursday when it was exploited in the wild in remote-code compromises against Minecraft servers. The source of the vulnerability was Log4J, a logging utility used by thousands if not millions of apps, including those used inside just about every enterprise on the planet. The Minecraft servers were the proverbial canary in the coal mine.

In the four days since, it’s clear Log4Shell, also known as LogJam, is every bit as grave a threat as I claimed, with the list of cloud services affected reading like a who’s who of biggest names on the Internet. Threat analysts and researchers are still assessing the damage so far and the outlook over the next weeks and months. Here’s what you need to know for now.

What’s Log4J and what makes Log4Shell such a big deal? Log4J is an open-source Java-based logging tool available from Apache. It has the ability to perform network lookups using the Java Naming and Directory Interface to obtain services from the Lightweight Directory Access Protocol. The end result: Log4j will interpret a log message as a URL, go and fetch it, and even execute any executable payload it contains with the full privileges of the main program. Exploits are triggered inside text using the ${} syntax, allowing them to be included in browser user agents or other commonly-logged attributes.

Read 7 remaining paragraphs | Comments

Blindflug und ein fragwürdiges Narrativ

Der Ton wird generell schärfer und aggressiver in Deutschland. Während die Schuld an der Krise oftmals eindeutig den Ungeimpften zugeschoben wird, gehen wichtige Fragen und Aspekte der aktuellen Krise unter. (Teil 2)

Der Ton wird generell schärfer und aggressiver in Deutschland. Während die Schuld an der Krise oftmals eindeutig den Ungeimpften zugeschoben wird, gehen wichtige Fragen und Aspekte der aktuellen Krise unter. (Teil 2)

Take one last look at Google Toolbar, which is now dead

Google Toolbar is dead, but we took it out for one last spin before it died.

The Google Toolbar website is still up and running. So is the download!

Enlarge / The Google Toolbar website is still up and running. So is the download!

Up until sometime this past week, deep in the bowels of Google headquarters, a dusty, forgotten server still whirred along. "Take the best of Google everywhere on the web!" it would shout to any poor soul who wandered by the darkened closet. "Google Toolbar is faster, sleeker and more personalized than ever before!"

Wait, what?

December 11 marked the birthday of Google Toolbar for Internet Explorer, which Google inexplicably left running nearly 21 years. We say "nearly" because we had this hands-on birthday post written ahead of time, asking, "How is this project still running?", but someone at Google was apparently on the same wavelength. We gave the website one last check before publishing and discovered Google Toolbar is dead. Google shut down the website sometime in the past week, just before its birthday. RIP.

Read 10 remaining paragraphs | Comments

Take one last look at Google Toolbar, which is now dead

Google Toolbar is dead, but we took it out for one last spin before it died.

The Google Toolbar website is still up and running. So is the download!

Enlarge / The Google Toolbar website is still up and running. So is the download!

Up until sometime this past week, deep in the bowels of Google headquarters, a dusty, forgotten server still whirred along. "Take the best of Google everywhere on the web!" it would shout to any poor soul who wandered by the darkened closet. "Google Toolbar is faster, sleeker and more personalized than ever before!"

Wait, what?

December 11 marked the birthday of Google Toolbar for Internet Explorer, which Google inexplicably left running nearly 21 years. We say "nearly" because we had this hands-on birthday post written ahead of time, asking, "How is this project still running?", but someone at Google was apparently on the same wavelength. We gave the website one last check before publishing and discovered Google Toolbar is dead. Google shut down the website sometime in the past week, just before its birthday. RIP.

Read 10 remaining paragraphs | Comments

Hohe Inzidenz auch beim Impf-Europameister Portugal

Die Lage in portugiesischen Krankenhäusern ist trotz vieler Neuinfektionen deutlich entspannter als vor einem Jahr. Impfungen zeigen hier Wirkung

Die Lage in portugiesischen Krankenhäusern ist trotz vieler Neuinfektionen deutlich entspannter als vor einem Jahr. Impfungen zeigen hier Wirkung

‘Copyright Troll’ Must Pay $60k Extra to Compensate Wrongfully Accused ‘Pirate’

Adult entertainment company Malibu Media continues to dig itself into a deeper hole. After it failed to pay tens of thousands of dollars to a man who was wrongfully accused of movie piracy, the company’s assets were restrained. And after a dramatic hearing last week, the total amount owed has more than doubled to $108,271.

From: TF, for the latest news on copyright battles, piracy and more.

x-artIn recent years, adult entertainment outfit Malibu Media has often been described as a copyright-trolling operation.

The company, known for its popular “X-Art” brand, has gone after thousands of alleged file-sharers in U.S. courts, collecting millions of dollars in settlements.

Accused Pirate Fight Back

Most accused pirates don’t put up a fight, but occasionally one does. They include Mr. W.M. who filed a counterclaim and demanded that Malibu should back up its claim with the digital evidence that led to their piracy accusation.

Despite a court order, this evidence never came in. This frustrated the court, the accused subscriber, and even Malibu’s own attorney, who withdrew from the case last year because her client failed to comply.

In the months that followed little progress was made and, earlier this year, U.S. District Court Judge Thomas M. Durkin handed a win to Mr. W.M. The court ordered Malibu to pay $48,656.73 in costs and attorneys’ fees.

Malibu Failed to Pay

In most cases an order like this would end things but, in this instance, things went from bad to worse. Malibu Media failed to pay up and on top of that, the company actively diverted funds that should have been used to pay these fees.

To recoup the money, Mr. W.M. hired Joseph Stewart, an experienced collection attorney. They went as far as obtaining a order that required Malibu Media and its payment processor Epoch.com to restrain the subscription revenue from “X-Art.com” members.

That order also applied to ZO Digital, a company operated by the husband of Malibu’s boss, Colette Pelissier, which collected well over $100,000 in proceeds during the first half of the year.

Things Escalate

A few weeks ago the matter started to escalate further. The court ordered Epoch to make sure that all Malibu’s proceeds are frozen and then sent to Mr. W.M.’s legal team, until the fees are paid off.

The Judge concluded that Malibu obstructed the legal process on several occasions, despite having sufficient financial means to pay. Harsh comments were also directed at Malibu’s designated representative Colette Pelissier, who failed to appear before a court without a proper reason.

To make sure that Pelissier attended an upcoming meeting Judge Durkin signed a conditional body attachment order. This effectively meant that she would be arrested if she failed to obey.

Court Drama

The threat of prison worked but things didn’t improve for Malibu and its CEO. During a digital court hearing last week, Mr. W.M.’s legal team requested that Malibu should pay additional legal fees, to cover the expenses that were incurred while trying to collect the previously awarded money.

We haven’t witnessed the hearing ourselves but copyright attorney and YouTuber Leonard J. French, who is not involved in this case, told us that the proceeding was quite messy.

Pelissier reportedly had a complete breakdown. She spoke quickly and panicky, while repeatedly interrupting the Judge, referencing issues that appeared to bear no relation to the case at hand.

Malibu’s boss also blamed lawyers for trying to profit from copyright lawsuits. She said the company has stopped filing new cases because she doesn’t want to be hard on people during the COVID pandemic and added that this is the only remaining case.

Judge Durkin asked her to slow down but that didn’t help much. Pelissier continued to interrupt which wasn’t appreciated by the court, to put it mildly.

“I deal with prisoners who are more appropriate, I have people who are mentally ill who can conduct themselves with more decency,” Judge Durkin said, before cutting off the call.

Fees Increase to $108,271

Shortly after the hearing, Judge Durkin issued an order partially granting the motion for extra fees. The post-judgment fees of $59,614 for the collection counsel and $764 in costs were awarded. However, the requested $23,775 for the prior counsel was denied.

granted

Malibu Media and its representative Collette Pelissier are jointly and severally liable for this amount and the same applies to ZO Digital.

Together with the pre-judgment fees that were granted earlier, Malibu Media must pay a total of $108,271 in fees and costs. This is one of the largest judgments we’ve seen in favor of a wrongfully accused file-sharer.

Collection Time

The next step is to actually collect the money and Mr. W.M.’s legal team continues to work on that. In a court filing submitted this week, they note that the payment provider Epoch has restrained $67,289 already.

Epoch is required to keep future Malibu Media (X-Art.com) fees restrained until the full amount is paid, which means that there’s roughly $41,000 to go.

A copy of Judge Durkin’s order granting the request to compensate the additional legal fees is available here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

To see proteins change in a quadrillionth of a second, use AI

Researchers can finally see how protein structures contort in response to light.

To see proteins change in a quadrillionth of a second, use AI

Enlarge (credit: Westend61 | Getty Images)

Have you ever had an otherwise perfect photo ruined by someone who moved too quickly and caused a blur? Scientists have the same issue while recording images of proteins that change their structure in response to light. This process is common in nature, so for years researchers have tried to capture its details. But they have long been thwarted by how incredibly fast it happens.

Now a team of researchers from the University of Wisconsin Milwaukee and the Center for Free-Electron Laser Science at the Deutsches Elektronen-Synchrotron in Germany have combined machine learning and quantum mechanical calculations to get the most precise record yet of structural changes in a photoactive yellow protein (PYP) that has been excited by light. Their study, published in November in Nature, showed that they were able to make movies of processes that occur in quadrillionths of a second.

Read 15 remaining paragraphs | Comments