DEV Community: Bit By Bit Club

Roadmap Series: Competitive Programming

Subh Chaturvedi — Sun, 08 May 2022 16:34:07 +0000

Competitive Programming is a sport. Consider a programming contest as a contest. Write a piece of code that should satisfy the problem presented and submit, you may get a WA (Wrong Answer). Make variations to code and eventually you will get your precious AC (Accepted/Correct Answer).

Here is how you can master Competitive Programming:

Choosing the right language:

The first step to take is to choose the right language to start your competitive journey with. You may try new languages and even find some other language suiting you better. The commonly used and recommended languages are:

Python: It is one of the easiest to learn language and has very simple syntax to implement. It has wide usage in domains like Machine Learning, Artificial Intelligence and Data Science if you decide to explore that domain.
Java: It is a very highly recommended language by coding communities. It is one of the most preferred languages for competitive programming and easy one.
JavaScript: It is the most popular scripting language and a staple of web-development. Many popular websites like Facebook, Twitter, YouTube, and Gmail use JavaScript to create interactive web pages and flexibly show content to users.
C: It is based on POP (Procedural Oriented Programming) where it divides programs into small functions.
C++: It is the most popular and recommendable programming language. C++ template includes data structures like Lists, Tree, Stacks, Graphs, Arrays etc. It follows OOPS (Object Oriented\ Programming) which help you to solve real time coding challenges.
Go: It is a low level language, open-source language preferential by Google. Useful to build web servers, data pipelines etc.
Ruby: It is an object-oriented language, user friendly, easy to learn. Dynamic Programming Language and also based on other programming languages like Perl, Lisp, Ada, Eiffel etc. It is used for Web Applications, Database Solutions and Data Science etc.

And many more. Once you learn any language, start practicing it. You can practice these languages from any website (I recommend Hackerrank). You can find these websites from search engines. Practice as many questions as you can and once you get confident about it you can go further.

Learning DSA:

After getting a grip in Programming language, now you can start
learning **Data Structure and Algorithms **with its application. To solve any problem or to crack any competitive programming, proficiency of syntax alone is not sufficient.
You should have knowledge about Data structures concepts and algorithms and its types with its implementation to solve real life problems.

Data Structure: Organising data and converting it to a well
structured one. Here is the list of Topics of Data Structure:

Arrays
Linked Lists
Stacks
Queue
Hash Tables
Tree
Heaps
Graphs

Whereas For algorithms, You should know following concepts with its application:

Searching Algorithm

Linear Search
Binary Search
Jump Search
Interpolation Search
Exponential Search
Ternary Search

Sorting Algorithm

Selection Sort
Bubble Sort
Quick Sort
Radix Sort
Merge Sort
Cycle Sort
Heap Sort
Bucket Sort

And a variety of others.

Practice Practice Practice:

Once you understand the techniques of solving the problem then below are some of the good sources of practicing competitive programming

LeetCode: Leetcode has a wide variety of problems that can be easy, medium, and Hard. Its advised to start solving Low and Medium problems and then gradually move to Hard Problems.
CodeChef: CodeChef doesn't need any introduction. This platform contains advanced competitive problems. It's better you don't directly jump to Codechef. Instead start with Leetcode and once you can solve their hard problems easily then gradually move to Codechef.

What is the Internet of Things, and how can we participate in its "savvy" revolution?

Anushkaa27 — Sat, 30 Apr 2022 10:55:42 +0000

Y’all might have heard that the Internet of Things is a key part of the Fourth Industrial Revolution....

The Internet of Things (IoT) sector has exploded in recent years.
According to study, the total cost of IoT technology was $646 billion in 2018. In 2022, this is expected to reach $1 trillion.
A slew of causes are driving this expansion. On the one hand, the
epidemic has resulted in an increase in the need for distant connectivity. New communication technologies, on the other hand, are opening up new options for developers and device makers.

What is IoT?

Now, talking about the basic understanding....
The internet of things, or IoT, is a network of interconnected computing devices, mechanical and digital machinery, items, animals, and people with unique identifiers (UIDs) and the ability to transfer data without requiring human-to-human or human-to-computer interaction.

A person with a heart monitor implant, a farm animal with a biochip transponder, a car with built-in sensors to warn the driver when tire pressure is low, or any other natural or manmade object that can be assigned an Internet Protocol (IP) address and can transfer data over a network are all examples of things in the
internet of things.

How is it transforming life specifically “workforce”.

Although the "Internet of Things" (IoT) may sound like a futuristic wave of talking refrigerators and self-starting vehicles, Internet-connected gadgets that interact with one another will have an impact on our lives beyond of the "smart home." Workers will benefit from IoT since it will save time and money while also providing new chances for development and innovation.

1. More data
The Internet of Things (IoT) will be a data processing powerhouse. This means that businesses will have to rethink how they collect and analyze data — not only will decision-makers need to learn and adapt to a new type of data intelligence, but the volume and variety of data generated by IoT will also introduce new or expanded roles for data analysts, strategists, and even customer service.

2. Know where everything is, all the time
One significant way IoT will increase productivity and efficiency is by making location tracking much simpler and more seamless. As
currently done in hospitals, Internet-connected equipment and devices will all be geographically tagged, which will save workers time hunting things down and save money by reducing the loss rate.

3. Get about more quickly
The Internet of Things (IoT) is the next big thing in your everyday commute. The interconnectedness of mobile devices, automobiles, and the road you drive on will help you save time by reducing travel time, allowing you to go to work faster or do errands faster.

4. Completely remote mobile device management (MDM)
IT departments may have remote access to computers and mobile
devices, but IoT will also enable remote control of other Internet-connected devices.

5. Difficulty in managing devices has risen.
The complexity of controlling linked devices increases as the number of connected devices grows. Smartphones, for example, are now widely used by workers for communication, productivity, and pleasure. They will be able to operate IoT-connected devices as well as do other tasks as a result of IoT.

Various IoT domains need different skills:

Those with inventive thinking and creative qualities who want an
interesting work environment, professional growth, and greater salary than IT experts can choose a career in IoT. Though it is an ideal topic for academics interested in contributing to technological growth, it should be noted that becoming a 'deep' IoT technologist is not straightforward, as understanding one platform or competence is insufficient.

IoT developers need to develop an inside out knowledge of programming to understand how the data can be collected, sent and stored at the server. Knowing software languages as JavaScript and Python as well as server-side languages such as PHP, ASP.NET, or Node.js. is a must.

Unlike other developers, those who work in the IoT space must have a deep understanding of sensors and wireless communication. A background in computer science for IoT information analytics, mobile apps, and UI development does help. For IoT device manufacturing, competencies in electrical, electronics and instrumentation engineering would be essential.
Beyond computing, IoT will take you into the world of mechanical and civil engineering as sensors gather physics data.
Knowledge of data science and big data management comes as an added advantage. Another important aspect is security. Lack of data security is the greatest threat the Internet of Things applications in all domains and some of the highest paying jobs are of security professionals

Career opportunities in the Internet of Things

Data Scientists
Network professionals
Embedded Programs Engineer starting from pcb design & manufacture, firmware engineer, thing engineering, complete product lifestyles cycle management, mechanical engineers, sign conditioning, digital sign processing, internet gateway interfacing and so on. Each discipline has a totally wide range of troubles to resolve for IoT.
Security experts for risk identity, vulnerability evaluation, public key encryption security and wireless community security.
Device and Hardware experts, especially in Sensors and Actuators are required in the R&D facilities of sensor

Would the change in name, also change the fortune ?

Amol Tandon — Sun, 24 Apr 2022 09:52:22 +0000

(A blog inspired by the recent losses that Facebook(Meta)
faced)

While Reading this blog , don’t pay much attention to figures ,
rather try to understand how established firms get setbacks worth
millions and billions and that too in a day. How difficult it is to sustain yourself in a competitive landscape without constantly
innovating. You would also get an insight into:
• The recent economic losses of Meta.
• Reasons which are constantly decreasing the user base of Meta.

Facebook was founded in the year 2004 by Mark Zuckerberg and it has been renamed as Meta recently.

Do you remember October 5? Yes , the day when everyone was bewildered as social media platforms like WhatsApp, Facebook went down due to a global outage.

Facebook now known as Meta is the parent company of WhatsApp , Instagram among other subsidiaries. Thus when the servers went down the losses piled up. It was reported that Mark Zuckerberg, the CEO of Meta (Facebook) slipped to the 5th spot in the billionaires' list as he underwent a loss of $7 billion in his personal assets. The parent company , Meta also suffered a deterrent loss of $160 million.

Everyone expected the year 2022 to usher in a new ray of hope and
strength, but for Zuckerberg, the destiny seems to treat him like a punching bag.

It was nearly 5 months later that Meta lost nearly $160 billion when the shares went down by 26%. Zuckerberg suffered a loss of $32 billion in his personal fortune , which is nearly the GDP of Estonia(A country in Europe).

Earlier the Market capital of the company was about $900 billion but after the stock-crash the valuation was reduced to $660 billion. This amounts to a loss of nearly \$240 billion . This is the biggest drop. Such a humongous drop was seen previously in the year 2018 , which was about $121 billion.

Knowledge fact: In India,like we have Sensex and Nifty. In the same way all the IT companies in the US are listed in NASDAQ.

Possible Reasons

1) The crash can be an immediate outcome of the "dismal" earnings report presented in an internal meeting. This report pointed to the fact that the company was facing huge losses and the same trend would continue in the coming future.

The profit of the tech giant declined by 8% to $10.29 billion in the last quarter of 2021.

The Revenue (forecast) is expected to hit \$27 billion-29 billion as against an analyst prediction of 30.15 billion.

2) As Facebook changed to Meta, there were general apprehensions that the social media giant would shift from social media networking to the virtual world of Metaverse.

3) When the crash took place, the subsidiary companies like Instagram, Messenger, WhatsApp recorded modest gain in the number of users, however the parent Company Facebook(Meta) lost about half a million of DUA(Daily Active Users).

This happened for the first time in the last 18 years. Experts are of the point of view that the new customer arrival on Facebook has received it's peak and the tech giant should expect similar user drops in the days to come.

Why is Meta Losing Users?

Cut throat competition due to the increasing presence of Tiktok

Tiktok claims to have over 1 Billion active users. This online video streaming platform that is used to make short length videos of 30-40 secs has attracted the youth and consequently increased its user base.
For these reasons Tiktok is steadily becoming the first choice of
advertisers.

In order to face this stiff competition posed by Tiktok, Instagram had released a feature known as "reels". But Instagram gets its main monetisation through Story and Direct feed features.

Youth deems Facebook(Meta) to be a place where old people catch up.

It has also become a general perception that Facebook is now "an old man's apparatus" which means , possibly due to peer pressure or due to the fact their family members are more into Facebook(Meta) , users have moved onto Instagram . Although the subsidiary company is benefitted but the Parent Company ends up making a loss. Young users prefer to interact and play at the same time due to which they either user Fortnite or Discord Servers.

There is no country left where Facebook(Meta) can expand it's operations.

Leaving aside a few exceptions like Iran and China , there is no country where Facebook(Meta) can think of gaining new Users.

4) Last year Apple had introduced a privacy feature in its operating system known as "App Tracking Transparency" .

This means that iPhone users would now have the liberty to decide
whether they want their online activities to be monitored or not. There are high chances that such permissions would not be granted by the users.

This would be huge setback for Meta as, much of it's business comes from online advertising after it trades user behaviour and data to specific companies.

iPhone users generally have greater spending capacity and they serve as a lucrative Market for advertisers . Thus this adds to the losses of Meta. New iOS rules will make Meta lose more than $10 billion in sales.

Advertisers are slowly moving to other platforms like Google and Tiktok that have large user base.

5) India also serves as a large market for Meta and a rise in tariff prices by Jio, Airtel and VI would be detrimental to it as users would limit their time on social media sites.

All these factors cumulatively played against the fortune of
Facebook(Meta).

Metaverse could be a reality in the coming future with the help of
virtual and augmented reality but at present instead of shifting the resources Meta should pay more focus on consolidating it's user base and dominating the advertisement market.

Is Innovation , a worrying issue for Meta?

You might actually know what News-Feed is. This concept revolutionised the way we interact with Internet . News-Feed actually brings the updated content from your friends onto your application. Earlier for applications like Myspace , you had to visit a particular friends profile in order to look what he/she has posted. After this innovation , Facebook(Meta) hasn’t really added some intriguing features. Many concepts are either copied or cloned (like reels from Tiktok). Meta, now should focus on strategies that disrupt the business world and at the same time draws and compels users towards it. Facebook should come up with ideas that aim to change the world.
I hope you not only enjoyed the blog but also understood how important it is to keep your users hooked to your social media networking platform(in this case Meta). How an operating system’s decision to prioritise user privacy can make you lose a big market share(in this case Apple’s decision)

Follow us on all social media platforms to get such amazing content (oops we too are not on Meta, sorry Mr. Zuckerberg). See you in the next blog.

How Shark Tank India portrayed technology to be the primary determinant in factoring the success of entrepreneurship

TANISHKA MISHRA — Sun, 17 Apr 2022 13:40:41 +0000

After the huge success of the television show Shark Tank in various countries, the franchise decided to bring the show to India and the first season had a great response from the audience and has brought a startup revolution in India.
The Shark Tank shows Sharks deciding whether to invest or not in a
business which has been showcased by entrepreneurs with the help of their business presentations. Nowadays everyone is intrigued by 'Shark Tank India', and the emerging startup culture. From a college student to a retired government employee, from a housewife to an IIT graduate, or from a 14-year-old teenager to a 70-year-old, anyone can find a way to the startup culture and become an entrepreneur.
Shark Tank India is a platform that connects entrepreneurs with Shark Investors. Shark Tank is one of the leading crowdfunding platforms in Asia, with thousands of startups on the platform. In recent years, it has directly funded over 165+ accelerators and individual investors around the world. Across media reports and word of mouth, thousands of entrepreneurs have been exposed to Shark Tank's process of screening and selection. The platform connects startups with investors who are willing to provide them with an initial fund round.

Technology is our master. In today's world where everything is
dependent on technology, technology proves to be the backbone of many of the emerging startups. It was showcased that the entrepreneurs whose ideas were solemnly based on technology proved to gain the highest amount of investments.
But before moving towards how technology proved to be eminent let's try to dig in on the growth of startups in India.

How startups are growing in India?

Startups are the ones stealing the limelight in twenty-first-century India. The growing startup ecosystem in India is one of the fastest-growing sectors in the country, with 651 start-ups and a start-up density of 7.4 per million inhabitants. India has changed from a land of agricultural activities at the turn of the 18th to the 21st century, where only 5% of people had access to digitals as we know it today. Entrepreneurship has been a part of Indian culture since day 1 with collective ingenuity, cooperation, and competition being key elements in shaping the country's economy.
The Indian Startup industry is also an example of the infinite new
possibilities that are rapidly taking shape under the leadership of the youth. Investor mania in the country has been playing a role in driving the start-up ecosystem and there has been a huge rise in infrastructural development increasing infrastructure supply. This signifies that India's growth is becoming more urban and improved infrastructure will lead to more opportunities for entrepreneurs.

How is technology a primary determinant factor?

The vigorous intervention of technology has helped the startups to move beyond the conventional tactics. Technology has become vital to startups. One of the most prominent uses of technology in startup culture is that it increases the flexibility of the business as well as of the employees. Automation is vital to improving the functioning of a business. The scope of growth of a startup is solemnly based on technology.

The technology helps a startup in its scope of growth.
Whether it's any industry, technology plays a significant role.
This is just the basic role of technology in every emerging Startup, but the startups that are solemnly based on technology are the ones that proved to be more successful when it comes to solving a problem. Thus, different technologies are like a savior for many startups.

Thinkerbell (Braille) :

The students of BITS Pilani Goa came together to make a project on
Raspberry pie which later emerged as one of the solutions to visually impaired children. The co-founders made a Braille Alphabet song box on Raspberry pie, which later emerged to be a learning device for the visually impaired.

The Raspberry pi based braille hardware also uses speech recognition software through a mobile application that acts as an interface. Annie is a way to help visually impaired children learn on their own without any external help. It helps them read, write and type. Tinkerbells labs raised 1.05 crores on Shark tank India which is one of the highest raises.

What exactly is Raspberry pi?

Raspberry pi is a mini-computer that has the size of a credit card and can fit into any computer or television. It enables people to learn to program and works exactly like a desktop computer.

It has a great role in project making and automation. Raspberry Pi runs Linux which is a computer operating system. The best thing about Raspberry pie is that it's not required to learn any high-level language and Linux to operate it as its motto is to teach so one can easily learn and operate it at the same time.

Road bounce (accident prevention):

Roadbounce is a device that detects and gives information about an
errand in the road before the accident occurs. It detects obstacles on roads to prevent mishaps.

Roadbounce was founded by Ranjeet Deshmukh and got a final deal of 80 lakh for 20% equity by Shark Peyush Bansal with a valuation of 4 crores. The device works on a mobile application and is based on IoT(Internet of Things).
Now let's dig more into the technology:-

IoT using smartphones

IoT has the potential to increase capital investment into assets.
To connect with an IoT network it requires to compliment a given
physical object along with necessary hardware, communication engine software, and compliment to common protocols.
Smartphones have all the necessary IoT components and can be used as IoT enablers but usually, 5000Rs may not work as efficiently as a 150000 would so to remove these barriers some statistical methods like 'Data Regression' is used to enable smartphones as a reliable data acquisition device which can be attached with anything.

Data Regression Basics

The technique to determine the statistical relationship among some
variables where the change in one variable ( suppose dependent variable) is associated with and depends on a change in another variable. It is utilized to evaluate acceleration and time.

Data smoothing

It is the process that removed the noise from the data set and allowed the important patterns to stand out.

Data filtering

An embedded system that refines the unrequired data by performing mathematical operations on a discrete-time signal to refine it by removing irrelevant and confusing data to reduce or intensify certain aspects of the signal. In this case, unwanted frequencies are removed to enhance the existing ones. This system uses electronic filters which are passive, active, analog, and digital.

Smartphone sensors are the sensing devices installed on a user\'s phone to gather data and information for various purposes, often in conjunction with a mobile app. Sensors act as converters that measure a physical quantity and convert it into a signal. Thus smartphones can be used as scientific tools. At a high-level mobile sensor are divided into
3 categories.

Motion Sensors: To measure acceleration and rotational forces along with the three axes motion sensors are used.
Position Sensors: Position sensors are used to measure the
physical orientation of the device.
Environment Sensors: Environmental parameters are most important and hence can be measured using environmental sensors.

PNT Robotics And Automatic Solution (robotics):

This Mumbai-based robotics start-up PNT creates technical products with automation and robotics.
Their working areas are various industrial control systems along with microcontrollers.

They manage both hardware and software integration and serve industrial automation to market according to the requirements using AI, ML, ROS, and IoT along with customized robotics solutions. One of the company's popular robots is ADO. This AI-powered robot performs humanoid actions like navigation, facial recognition, human gestures, and many more. They bagged ₹25 lakhs investment for 25% equity and ₹25 lakhs debt from the shark Peyush Bansal founder of Lenskart.
One of the company's popular products ADO which is a fully automated humanoid robot with human-like emotions and gestures which is powered by Artificial intelligence and uses ROS as their robot operating system which is a free and open-source that defines the components, interfaces, and tools for building advanced robots.

Most robots are made up of actuators: things that move, sensors and control systems, or the robot's brain. ROS helps developers quickly build these components and then easily connect them using ROS tools called topic and messages.

These messages can be recorded using ROS bag files or logs for easy testing, training, and quality assurance. Messages can be easily sent to a variety of visualization and teleportation tools. With ROS you can work with a simulated robot instead of a real thing which some call a "digital twin". This also makes testing and training easier and more effective.
ROS supports hardware interfaces for many common robot components like cameras, LIDARs, and motor controllers. ROS's modular architecture allows developers to build robots free from vendor lock-in or licensing fees.

Proxgy(VR):

Proxy was launched during the pandemic era and works as a global service for users to pick a real-world avatar. People can navigate physical spaces through the Avatar and can experience a live experience indoors. It has a 360-degree rotation camera on the proxy smart helmets with 3D viewing and broadcasting services for its tech stack. Proxy has marketed this tool for various experiences including shopping, traveling, viewing real estate. The startup received an investment of 1 crore with 10% equity.

Virtual Reality and IIoT (Industrial IoT) are the dominating
technologies in the development of Proxgy. VR framework enables us to experience virtual presence in a collaborative and intelligent way.

Virtual Reality (VR) is typically a computer-generated environment with scenes and objects that appear to be really making the user feel immersed. The device which is used to perceive the environment is known as VR headset or helmet.

While wearing the headset we can experience a real world at our
fingertips by using the Proxgy app. The IIot is a network of intelligent devices connected to form systems to monitor, gather and analyze the data. Every industrial IoT system consists of:-

Devices that have the ability to sense, collect and store
information
Infrastructure based on public and private data communications.
Generation of storage by IIot devices.

The app can be integrated with existing tech to bring revolution in teaching, business and to bring solutions.

Loka:

Loka is India's first Metaverse gamified app based on real locations, populated by real players & experiences powered by hundreds of 3rd Party Apps. Loka's primary factor of usage is in Social Engagement, Gaming, E-commerce, Content consumption, and Entertainment purposes.

In the game world, you can explore the streets, lanes of Delhi\'s iconic Connaught Place area or the famous Sarojini Nagar including bustling parks. It is a platform on which you can do things like having conversations with the players, watching a movie in the theatre, shopping and ordering food, or having fun with your friends. This Bangalore-based start-up, founded by Krishnan Sundararajan, has created a metaverse gaming app for Android and iOS users and received ₹14 lakh investment for a 24% equity stake on Shark Tank. The app uses the most talked about metaverse which is a network of 3D virtual worlds focused on social connection. Metaverse is a virtual reality world, where users can interact, game, and experience things as they do in the real world.

Metaverse is a combination of multiple elements of technology, which includes virtual reality, augmented reality, and video where users 'live' virtually. As discussed above, AR(Augmented Reality) and VR are the cornerstones for metaverse projects. AR technology holds the edge over VR tech as it can be used in any camera-enabled device. AR acts as an informational enhancer.
VR is an entirely simulated experience in a digital world. VR delivers sensory experiences. Loka adds another layer over this which consists of small elements like Ambient Sounds, Background Noises, NPCs, Culture-Specific Virtual Goods, etc. to retain the feel & relevance of the location.

Altor(smart headgears):

Altor is a 2018-established VC and Government of India-backed
startup based out of Kolkata, India. Altor is a new-age tech company dealing in IoT and ML applications for two-wheeler automotive industries. Altor Smart Helmet is India's first software-enabled helmet module to make bike rides easier, safer, and more efficient, specifically targeted towards increasing the fleet efficiency of two-wheeler-driven economies helping the delivery, logistics, and bike-sharing sectors. The device detects any accidents with the user and sends an emergency message with the last location of the user to all ICE contacts. In case of a false alarm, the user gets a time limit to cancel the process.
Altor received an investment of ₹50 lakh for 7% equity by Aman Gupta & Namita Thapar combined.

Altor uses IoT and ML technologies for developing its smart headgears. Machine Learning is a branch of Artificial Intelligence that comprises programming software in such a way that it could make decisions on and are trained to predict outcomes through statistical predictions and classifications. The Internet of Things (IoT) describes physical objects embedded with sensors, processing ability, software, and technologies that connect and exchange data with other devices and systems over the Internet or other communications networks. The device itself includes an integrated CPU, network adapter, and firmware, which is built on an open-source platform. A Dynamic Host Configuration Protocol server connects to IoT devices and acquires an IP address to help the device function on the network. Machine Learning plays a very important role in Altor's development.

Note of Closure:

These are some tech startups among many which were featured on Shark Tank. They show us how people with vast knowledge of numerous technologies can become successful entrepreneurs.
Shark Tank India has put a light on some of the leading tech startups of our country. The aim of these startups revolves around revolution for mankind with the help of leading technologies like AI, ML, IoT. They have got the recognition they needed which makes us believe that India is leading towards becoming a digital nation.

How an overlook in development wreaked havoc on the internet - The Log4Shell Vulnerability

Jaiyank S. — Mon, 04 Apr 2022 10:16:06 +0000

Java is a funny language. The people who use it can often be found ranting about it on reddit. It is heavily criticized for its design choices over the years and it's no surprise that developers who code in it are bound to give way to serious security vulnerabilities, if not too careful.

One such is the recent vulnerability in Log4j, also nicknamed as Log4Shell - this particular vulnerability was so severe and the extent of which was so huge that it wreaked havoc on the internet and ruined Christmas for almost everybody that was responsible to fix the mess. In this blog, we'll be understanding the why and the how that led to this chaos.

What is Log4j?

Log4j is one of several java-based logging frameworks and comes under Apache's Logging Services. Being open-sourced, it is and has been maintained by contributors from all over the globe since many years (more on this later).

It logs events - from errors to diagnostic messages and more, so that system administrators and developers can look at them later. For example, when you try to login on a website and it shows an error message like incorrect password, log4j can be used to record that.

Some Technical Jargon

Let's understand some technical terms related to log4shell before we move forward and dive deep into it. This will make concepts clearer.

Java Naming and Directory Interface (JNDI)

Java has a lookup feature called JNDI, which is an interface that allows java applications to access naming and directory services. It has an API and a SPI. Different naming and directory services like LDAP, DNS, and RMI connect to this JNDI SPI which is then accessed by the java application using the JNDI API, the diagram below illustrates this.

So, this is basically like asking your friend to get you something from someone in a different hostel room. You tell your friend the path (the protocol), the room number and the item (the file path) you need to get. Here you act as the java application, your friend acts as the API and SPI.

Remote-Code Execution (RCE)

Remote-Code Execution, or RCE for short, is a class of vulnerabilities which allows an attacker to execute arbitrary code on a remote device. These RCE vulnerabilities can be a result of a variety of things ranging from Injection attacks (SQLi, HTML injection, PHP injection, etc.), Cross-Site Scripting, De-Serialization attacks to even Business-Logic flaws.

Say for example, you use a certain software for taking notes. A malicious* hacker finds a vulnerability that allows them to achieve RCE. The implication of this is that they can run any command they want on your computer! Using the RCE exploit, the attacker can launch a ransomware attack against you and lock your data, they can spy on you or steal your passwords or even make you part of a secret botnet!

Every time you use a piece of software you're essentially putting incredible trust in the security and integrity of the said software. Scary isn't it?

*A small note about "hackers"

The term "hacker" is often misrepresented due to pop culture and ignorant news reporting - not all hackers wear hoodies, sit in a dark room with green text flashing before their eyes! In fact, the term "hacker", in its right sense, is used for an individual who uses their extraordinary skills in computer, networking or other domains to overcome technical limitations and problems.

Not all hackers are bad and malicious! There are indeed hackers who use there skills to do illegal activities, but it's only a subset of the whole cybersecurity community - contrary to popular belief, majority of hackers are actually dedicated to make the internet more secure!

How does Log4Shell actually work?

We now know about Log4j, JNDI and RCEs, let's discuss how this relates to the Log4Shell vulnerability. Log4J allows JNDI lookups to enhance the quality of logs. A use-case of that might be logging the hostname or the IP address with the diagnostic message.

For example, ${jndi:ldap://example.com/file} asks JNDI to use the LDAP protocol to get the specified file hosted on the LDAP server. JNDI returns the object to log4j and it stores it. Now you might already know where this is going - Untrusted JNDI lookups to attacker-controlled servers!!!

An attacker could submit a string specifically crafted to tell log4j to use JNDI and retrieve a malicious payload hosted on the attacker's server. Log4j will store the object and Java will execute it resulting in RCE!

Initial Detection and The Impact

Believe it or not, this vulnerability was discovered on a Minecraft server! So, all this chaos was a result of just some gamers messing around - internet is a gift that keeps on giving!

The impact of this is HUGE. Every single service that uses Java and Log4j for their logging purposes might be vulnerable to log4shell. iPhone, Steam, Minecraft, Twitter, Google, Tesla, Microsoft were just among some of the biggest vendors affected by this.

Although a patch was issued, the impact doesn't stop here. There might still be hundreds of thousands of websites affected by this and they won't even know about it until much later. It is estimated we'll see the implications of this for years to come.

On March 22 2022, Okta was hacked where it is believed to be the work of LAPSUS$ hacker group. It is being speculated that the hack was a result of an earlier log4shell exploitation in Okta's infrastructure.

What led to this?

Looking at all of this, a question arises - How did all of this even happen? What led to this? Didn't anybody catch it earlier? The thing is that Log4j is open-source. Lots of contributors spend their time and effort in contributing to this and hence, this type of overlook in development is perfectly normal and possible.

The surprising part though, is that this vulnerability has existed since 2013! This means for almost 9 years it went undetected even after several researchers warned about untrusted JNDI lookups and attack vectors involving it. As a community, we need to be proactive in researching and mitigating issues like these before they pop up.

Closing Remarks

The likes of Log4Shell RCE vulnerabilities are said to be found once in a decade - and we saw this type of damage done by EternalBlue used during the WannaCry ransomware attacks. It poses a question - What's waiting for us in the future and How many more vulnerabilities like these are still out there, just waiting for another gamer to stumble upon them?