Cybersecurity and Infrastructure Security Agency (CISA), under the supervision of DHS, has issued an alert to companies around the world and urged them to take immediate action. The housing market is also at risk as it relies heavily on technology.
MB Daily News-Raleigh, NC: What is at risk if hackers exploit this bug? this piece of software is very common in our daily lives when we use computers at home and at work. It connects to computer networks and routers. There have been thousands of recent attempts recently recorded by hackers to gain access to critical infrastructure, government systems, and private companies’ networks. The threat is real and it requires collaboration from governments and the private sector to minimize the impact of this flaw.
Companies like Amazon, Cisco, and Microsoft have been issuing patches to their systems. According to Cybersecurity researchers the bug, hidden in obscure server software called Log4j, represents one of the biggest risks seen in recent years because the code is widely used on corporate networks.
CISA Director Jen Easterly said Saturday: “To be clear, this vulnerability presents a severe risk. We will only minimize potential impacts through collaborative efforts between the government and the private sector. ” Germany’s cybersecurity organization issued a “red alert” over the weekend about the bug. Australia called the issue “critical”.
Security experts warned that it could take weeks or more to assess the extent of the damage and that hackers exploiting the vulnerability could access sensitive data on networks and install back doors they could use to maintain access to servers even after the flawed software has been patched.
“It is one of the most significant vulnerabilities that I’ve seen in a long time,” said Aaron Portnoy, principal scientist with the security firm Randori.
Security experts noted that many companies have other processes in place that would prevent a malicious hacker from running software and breaking into these companies, potentially limiting the fallout from the bug.
The software flaw was reported late last month to the Log4j development team, a group of volunteer coders who distribute their software free-of-charge as part of the Apache Software Foundation, according to Ralph Goers, a volunteer with the project. The foundation, a nonprofit group that helps oversee the development of many open-source programs, alerted its user community about the vulnerability on Dec. 9.
“It’s a very critical issue,” Mr. Goers said. “People need to upgrade to get the fix,” he said. Log4j is used on servers to keep records of users’ activities so they can be reviewed later on by security or software development teams.
Because Log4j is distributed free, it is unclear how many servers are affected by the bug, but the logging software has been downloaded millions of times, Mr. Goers said.
It isn’t the first time that open-source software has sparked security concerns. In 2014, internet users worldwide were urged to reset their passwords after another issue, known as Heartbleed, was discovered in OpenSSL, an obscure yet similarly ubiquitous piece of internet software built by volunteers.
Hackers started exploiting the flaw widely early Friday, including to gain access to servers running Microsoft’s Minecraft gaming software, researchers said. The researchers soon observed widespread scanning and attempt to trigger the Log4j bug across the Internet. In a note published Friday, Microsoft advised some Minecraft gamers that they should upgrade their software to patch the bug.
During a roughly 24-hour period, the security firm Check Point Software Technologies Ltd. said it saw more than 100,000 attempts to exploit the bug, about half of which it estimated were from malicious cyber attackers. The rest were by legitimate researchers, either government scanning national infrastructure or security researchers, Check Point said.
A Dutch researcher, Cas van Cooten, said he discovered the bug on Apple Inc.’s AAPL 2.80% servers, potentially giving him a way of running code within Apple’s network. Mr. van Cooten said he immediately reported the issue to Apple.
“It would have been trivial for a malicious hacker to weaponize this,” he said. An Apple spokesman didn’t respond to messages seeking comment.
Another researcher, Carson Owlett, said that consultants working with his security firm, Black Mirage LLC, we’re able to detect the bug on systems run by other companies, including Twitter and LinkedIn, also owned by Microsoft.
“Our teams are looking into it, but we have no details to share at this time,” a Twitter spokeswoman said via email Friday. A LinkedIn spokeswoman said via text message that “while we’re responding to this, just as security teams at many companies are, we’re not experiencing any active issue.”
Because all sorts of data are logged by servers, everything from email addresses to web navigation requests, these attempts could give attackers a foothold on a vulnerable server deep in corporate networks, said Ryan McGeehan, an independent security consultant who was formerly a director of security at Facebook. “A successful attack is like creating a wormhole,” he said. “The attacker can’t be sure where they’ll end up.”
Cisco is investigating more than 150 of its products to look for the Log4j bug. So far, it has found three vulnerable products and determined that 23 aren’t vulnerable, a company spokesman said Saturday.