"Internet's On Fire Right Now": Millions Of Devices At Risk Over New Software Vulnerability
"Internet's On Fire Right Now": Millions Of Devices At Risk Over New Software Vulnerability
BY TYLER DURDEN WEDNESDAY, DEC 15, 2021 - 08:20 AM Authored by Jack Phillips via The Epoch Times,
A newly discovered flaw in a common piece of open-source
software is prompting researchers and companies to update their systems in a
bid to prevent hacks and ransomware attacks.
The vulnerability, known as CVE-2021-44228,
was disclosed on Dec. 9, which allows remote access to servers and code
execution, some experts have said. Meanwhile, Log4j is used in a large
number of enterprise systems, raising concerns that it may be easily exploited.
Since the vulnerability, which some dubbed “Log4Shell,” so is
widespread and is likely present in highly-trafficked websites and apps, users
may also see their favorite websites and apps be impacted.
Cybersecurity firms Mandiant and Crowdstrike said that hacking
groups are trying to breach systems, and Mandiant described to Reuters
that they are “Chinese government actors,” in
reference to the ruling Chinese Communist Party.
“Given that Log4j has been a ubiquitous logging solution for
Enterprise Java development for decades, Log4j has the potential to become a
vulnerability that will persist within Industrial Control Systems (ICS)
environments for years to come,” according to a blog post by
cybersecurity researchers at Dragos.
A cybercriminal can exploit the flaw by sending a malicious code
string that will get logged by the Log4j version, allowing the attacker to
load an arbitrary Java code to a server. The vulnerability could potentially
allow them to take control of the server.
Federal cybersecurity officials also reportedly expressed alarm
over the vulnerability in recent days.
“This
vulnerability is one of the most serious that I’ve seen in my entire career, if
not the most serious,” Jen Easterly, the head of the
U.S. Cybersecurity and Infrastructure Security Agency (CISA), said on
a phone call. The Epoch Times has contacted CISA for comment.
Easterly warned that CISA can “expect the vulnerability to be
widely exploited by sophisticated actors and we have limited time to take
necessary steps in order to reduce the likelihood of damaging incidents.”
The proverbial canary in the coal mine was when researchers
noted that Minecraft’s servers could be compromised via the vulnerability.
Microsoft last week posted instructions for how players could update the game’s
Java version.
“This exploit affects many services—including Minecraft Java
Edition,” said Microsoft.
“This vulnerability poses a potential risk of your computer
being compromised.”
In another stark warning, Cloudflare CEO Matthew Prince wrote Friday that
his firm has “made the determination that Log4J is so bad we’re going to try
and roll out at least some protection for all Cloudflare customers by default,
even free customers who do not have our [enterprise suite]. Working on how to
do that safely now.”
“It’s a
design failure of catastrophic proportions,” Free
Wortley, the CEO of the open-source data security platform LunaSec, wrote on its website last week.
Elaborating on what services could be targeted via the exploit,
Wortley said that “Cloud services like Steam, Apple iCloud, and apps like
Minecraft” have been discovered to be vulnerable. “Anybody using Apache Struts
is likely vulnerable. We’ve seen similar vulnerabilities exploited before in
breaches like the 2017 Equifax data breach,” he said, referring to the hack
that released millions of people’s credit data.
Last week, CISA issued an alert over
the vulnerability, as did Australia’s
cybersecurity agency. The Apache Software Foundation rates the vulnerability
as “critical” and published ways to deal with it on Friday.
“The
internet’s on fire right now,” warned Adam Meyers, a
senior vice president with Crowdstrike. “People are scrambling to patch,” he told The
Associated Press, “and all kinds of people scrambling to
exploit it.”
Comments
Post a Comment