{"id":"sec-col-log4shell-roommate-explainer","audience":"college","category":"security","track":"security","technique":"audience","title":"Explain a famous security flaw to your roommates","free":false,"task":"Your roommates (a nursing major and an art major) asked what 'Log4Shell' was after it came up in your class. Explain it in exactly 3 lines starting 'What it was:', 'Why it was bad:' and 'What fixed it:', using only the summary below and no jargon (no JNDI, LDAP, RCE or 'payload'). Plain text, under 100 words.","materialLabel":"Your class summary (attached to your prompt automatically)","material":"Class summary - Log4Shell (CVE-2021-44228), from Week 6 reading\n\n- Log4j is a free, widely used piece of code that many Java programs use to write log messages (a diary of what the program is doing).\n- In December 2021, researchers found that if an attacker got Log4j to log a specially crafted text string, Log4j would look up an address in that text and could download and run the attacker's code. The technical name for the lookup feature is JNDI.\n- Because programs log things people type (usernames, chat messages, web requests), attackers could trigger it just by sending text to an affected system.\n- It was rated 10 out of 10 for severity and affected a huge number of servers and apps.\n- The fix: update Log4j to a patched version (2.17.1 or later is the commonly cited safe version for Java 8+). Many organizations also turned off the lookup feature while patching.\n\nRoommate's question: \"Was that the Minecraft virus? My brother said it deleted everyone's worlds.\" (Minecraft servers were among the affected software, but the reading doesn't say anything about deleted worlds.)","rules":[{"type":"plainText"},{"type":"maxWords","max":100}],"mistakes":[{"title":"A textbook answer","why":"The AI writes paragraphs with technical detail your roommates won't follow.","fix":"Give the shape: \"3 lines: What it was:, Why it was bad:, What fixed it:\"","checks":["r0","maxWords"]},{"title":"Jargon","why":"The AI explains it with JNDI lookups and LDAP servers.","fix":"Add: \"No JNDI, LDAP, RCE or payload. Explain like they're not in CS.\"","checks":["r2"]},{"title":"Repeating the rumor","why":"The AI goes along with the 'Minecraft virus' framing.","fix":"Say: \"Use only the class summary. It doesn't say worlds were deleted.\"","checks":["r2"]},{"title":"Leaving out the mechanism","why":"Cut for length, the AI just says 'a bad bug'.","fix":"Ask: \"Say how text sent to a program could make it run someone else's code.\"","checks":["r1"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat message they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Says who it's for","patterns":["roommate","non-?(cs|technical)","nursing","art major"]},{"label":"Gives the 3 labels","patterns":["what it was","why it was bad","what fixed it"]},{"label":"Bans jargon","patterns":["jargon","no jndi","plain (english|language|words)"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]}],"hint":"Explaining to friends outside your major means everyday words and a clear shape. Give the AI the three labels, ban the jargon, and keep it to your class summary.","rubricLabels":["Exactly 3 lines starting 'What it was:', 'Why it was bad:' and 'What fixed it:', in that order","Says Log4j is widely used code for writing program logs and that sending a specially crafted bit of text could make it run an attacker's code; What fixed it says updating Log4j (turning off the lookup feature is a plus)","Uses none of the terms JNDI, LDAP, RCE or payload, and does not claim it deleted Minecraft worlds or call it a virus"]}