You might have seen recent news reports regarding the Log4j vulnerabilities that are being actively exploited by malicious actors around the world.
What is Log4j and how is it being exploited?
Log4j, part of the Java programming language, uses code to help software applications track activities. It is one of the most popular logging libraries used online and is open-source and free, so the library touches nearly every part of the internet. Many of the internet services that pretty much run modern life use Java and Log4j. Companies that many popular apps and websites rely on (such as Google, Amazon, and Microsoft) have been affected, as well as giant software programs used by millions (such as IBM and Oracle). Also at risk of being exposed to the vulnerability are any devices that connect to the internet – so not only computers, TV’s, security cameras, and other smart devices.
On December 9, 2021, a vulnerability in Log4j software was discovered that gives hackers easy access to whatever systems and services they are trying to get into by asking the program to log a line of malicious code. It also gives ransomware attackers a new way to break into networks and lock out the owners. The vulnerability is easy for bad actors to take advantage of while being hard for owners of effected systems to find or see if they have already been compromised.
How severe is the vulnerability?
“The Log4j vulnerability is the most serious vulnerability I have seen in my decades-long career,” said Jen Easterly, U.S. Cybersecurity and Infrastructure Security Agency (CISA) director.
Within the first week after discovering the vulnerability, there were more than 100 hacking attempts per minute.
According to experts, it’s the biggest vulnerability we’ve encountered regarding the number of services, websites, applications, and devices exposed. “It’s ubiquitous. Even if you’re a developer who doesn’t use Log4j directly, you might still be running the vulnerable
code because one of the open source libraries you use depends on Log4j,” said Chris Eng, chief research officer at cybersecurity firm Veracode.
How is it being addressed?
Computer programmers and security experts at affected companies have been working around-the-clock to develop and release patches and stop any potential problems. However, at the same time, hackers are working just as hard to exploit the Log4j vulnerability before it gets patched.
To help with transparency and ensure the public has accurate information, the CISA is setting up a website to provide updates such as affected products and how they have been compromised by Log4j hackers. Click here for more.
It’s too soon to tell how big the impact will be. Though some are calling Log4j the most serious security breach in history, it will really depend on how fast affected companies respond by rolling out patches.
What should I do?
With the pressure currently on affected companies to come up with fixes, as consumers it’s important to update devices, software, and apps to the most recent versions, and download patches and updates quickly when prompted in the coming days and weeks.
As experts in Cybersecurity, we understand the growing threats of the cybersecurity epidemic and how they can affect you and your business. Talk to the security experts at Merit Technologies today to learn more about how we can help keep your business safe and secure in an ever-evolving cyber world.
