The Amazon Web Services (AWS) “hotpatch” released in response to the Log4Shell vulnerabilities could be used for container escape and privilege escalation, allowing an attacker to take control of the underlying host.

“Aside from containers, unprivileged processes can also exploit the patch to escalate privileges and gain root code execution,” said Yuval Avrahami of Palo Alto Networks Unit 42 in a report published this week.

The flaws — CVE-2021-3100, CVE-2021-3101, CVE-2022-0070, and CVE-2022-0071 (CVSS scores: 8.8) — affect AWS hotfix solutions because they are designed to search for Java processes and patch them against the Log4j flaw on the fly, but without ensuring that the new Java processes run within the container’s restrictions.

“Any process that runs a binary named ‘java’ – inside or outside of a container – is considered a candidate for the hot patch,” Avrahami explained. “A malicious container could thus have included a malicious binary named ‘java’ in order to trick the installed hot patch solution into invoking it with elevated privileges.”

In the following step, the malicious ‘java’ process could use the elevated privileges to escape the container and gain complete control over the compromised server.

In a similar manner, a rogue unprivileged process could have created and executed a malicious binary named “java” to trick the hotpatch service into running it with elevated privileges.

Users should upgrade to the fixed hot patch version as soon as possible to avoid potential exploitation, but only after prioritising patching against actively exploited Log4Shell flaws.

“Containers are frequently used as a security boundary between applications running on the same machine,” explained Avrahami. “With a container escape, an attacker can expand a campaign beyond a single application and compromise neighbouring services.”

The post  Amazon Web Services’ hotpatch in response to Log4Shell vulnerabilities could be used to gain access to sensitive systems appeared first on The Tech Outlook.

Evergreen programming languages are-

• Java
• Python

There are a few more but here we are going to detail about, “how commanding over these two great programming languages may land you to your dream job, even if you aim for Big Tech”.

No doubt in saying that IT companies are paying very well to their employees as compared to other professions where employees are not paid enough according to the efforts they made or how much they sweat. But there lies a  myth that only Engineers are able to join these IT professions like developer, database administrator, data scientist, etc. Anyone with knowledge of programming language, where Java and Python are the widely used industrial programming language can aim for these IT posts.

As Java and Python are dominating in IT industries, let’s talk about in detail one by one-

JAVA-

The wide application of java makes it a versatile programming language for many years.  Java application extends from Mobile Application, Desktop GUI, Web-based application to server-based application.

Java is used in different fields like- Science, Enterprise, Gaming, Big Data, Cloud-based, Distributed systems.

You can find Java on over 3 billion devices! according to Oracle.

Major characteristics of Java that makes it most popular-

• platform-independent – can work on different platforms like Windows, Mac, Linux, etc
• object-oriented – allows code reusability and clear programming structure follows OOPs
• simplicity – easy to learn and code
• concurrency – allows multiple statements to execute simultaneously
• security- java is secure and fast
• open-source – free language with the wide community to support

Java is used by almost all IT companies, few giants are – Google, Airbnb, Amazon, Spotify, Netflix, Uber, Pinterest,

Python-

The popular and most fascinating programming language in terms of its syntax is Python. The major factor that there is huge acceptability of Python is because of its simple programming syntax than other programming languages that have tough syntax. It is called “developer-friendly language”.

Python is a trending language as it suites with all current and future technologies like Artificial Intelligence, Machine Learning, Data Science, Data Analytics, Data visualization, Business Intelligence, SEO, design, Game development, etc.

Major characteristics of Python that makes it an ideal programming language-

• easy – as compared to most of the coding languages
• simple syntax – more like English, easy to read and understand
• object-oriented – allows code reusability and clear programming structure follows OOPs
• interpreted – easier to debug
• platform-independent – can work on different platforms like Windows, Mac, Linux, etc
• GUI support – Graphical User Interface can be made through different modules of Python
• open-source – free language with the wide community to support
• libraries – Python has a large set of libraries for different functionalities that reduces code complexity
• dynamic nature – Python is a dynamically-typed language

NASA, IBM, Google, Netflix, Spotify, Pixar, Facebook, JP Morgan Chase, Intel, and countless more all use the language to help power their services. Python is among one of the 4 major languages at Google and also Google’s youtube is majorly coded on Python.

Confused which to choose between Java and Python?

These key differences may help you-

• Java is compiled whereas Python is interpreted- that means error checking or debugging in python is simple.
• Java is statically typed whereas python is dynamically typed – again its easier to go with python
• Java has complex learning curve than Python
• Java offers more security than Python
• Java is preferred for Desktop GUI apps, Embed Systems, Web application services, etc whereas Python is used for scientific and mathematical systems, Machine learning, etc.

The post 2 programming languages guaranteeing landing in big tech companies, even for non-engineers appeared first on The Tech Outlook.

Java script developers want to eat their own baked cake. They want both shiny and reliable java -According to the 2020 State of JavaScript report state. There were few things that were missing from JavaScript which developers absolutely missed. Those were Static typing, Standard library, and pattern matching.

Microsoft-built TypeScript is the predominant feature of last year’s survey of over 23000 JavaScript developers.

TypeScript’s widespread adoption is setting the bar to the next level by popularizing static typing- the author told.

TypeScript came in 2012 as a superscript of JavaScript. TypeScript doesn’t detract from JavaScript’s features but offers an extra feature i.e. an erasable type system that will remove types and will return them to JavaScript when code is compiled. Out of 23,756 JavaScript developers around 91% were identified as male. Third of them reported their annual income between $50,000 to $100,000.

Meanwhile, 70% of them were white, while 13% said they were Asian, and 11% identified as Hispanic. 3.2% said they were Black or of African descent, and 4% said they were from Middle Eastern nations.

JavaScript and TypeScript follow the ECMAScript standard.

According to the survey, TypeScript is the developers’ choice in terms of JavaScript flavors. It is used by 93% of developers whereas Elm was once a popular choice but now it is used by only 63% of respondents.

PureScript, Reason,and ClojureScript is used by 72%, 71%, and 59% respectively.

The post What JavaScript developers prefer? appeared first on The Tech Outlook.