Log4j Cyber Security Flaw Seriously Concerns Experts

A critical flaw in widely used software has cyber security experts raising alarms and big companies racing to fix the issue. The vulnerability is in Java-based software known as "Log4j" that many large organisations use to configure their applications and it poses potential risks for much of the Internet.

The US Cybersecurity and Infrastructure Security Agency (CISA) has now issued a statement ordering all civilian federal agencies to patch the Log4j vulnerability. 

The Log4j vulnerability is currently being widely exploited by a growing number of threat actors, prompting government officials to take action.

The flaw presents a high threat to companies given its broad use and active exploitation. The issue lies in a commonly used utility that has been incorporated into countless pieces of software because it is open source, meaning anyone can use it. Log4j is principally uses as a tool to log activity for many computer systems. Developed and maintained by a handful of volunteers under the auspices of the open-source Apache Software Foundation, it is extremely popular with commercial software developers. It runs across many platforms, powering everything from webcams to car navigation systems and medical devices, according to the security firm Bitdefender

The flaw in Log4j allows attackers to  seize control of everything from industrial control systems to web servers and consumer electronics. Unless it is fixed, it gives a potential opening to internal networks where cyber criminals can loot valuable data, plant malware, erase crucial information and more. The first obvious signs of the flaw's exploitation appeared in the Microsoft online game Minecraft, when users were able to use it to execute programs on the computers of other users by pasting a short message in a chat box. 

Apache Software Foundation said the Chinese tech giant Alibaba notified it of the flaw on November 24 and the  Foundation rates the risk at 10 out of 10.

CISA is working closely with our public and private sector partners to proactively address a critical vulnerability affecting products containing the log4j software library. "This vulnerability, which is being widely exploited by a growing set of threat actors, presents an urgent challenge to network defenders given its broad use’  according their latest statement.

CISA has added the harmful flaw to its Known Exploited Vulnerabilities Catalog and created a new landing page for all content regarding the vulnerability. CISA is providing insight to organizations via the Joint Cyber Defense Collaborative that includes numerous US  cybersecurity companies. 

  • The US Department of Homeland Security has ordered federal agencies to urgently eliminate the bug because it is so easily exploitable, and telling those with public-facing networks to put up firewalls if they cannot be sure.
  • In Australia, the Australian Cyber Security Centre has issued a critical alert urging organisations to apply the latest patches to address the weakness.

The Director od CISA, Jen Easterly, was reported describing  the flaw "one of the most serious I've seen in my entire career, if not the most serious".

A wide range of critical industries, including electric power, water, food and beverage, manufacturing and transportation, were exposed, according to cyber security firm Dragos and CISA recommends asset owners take some  immediate steps regarding this vulnerability:

  • Enumerate any external facing devices that have log4j installed. 
  • Make sure that your security operations center is actioning every single alert on the devices that fall into the category above.
  • Install a web application firewall (WAF) with rules that automatically update so that your SOC is able to concentrate on fewer alerts.  

CISA's concerns over Log4j highlight the importance of building secure software from the outset and more widespread use of Software Bill of Materials (SBOM), providing end users the transparency they require to know if their products rely on vulnerable software libraries. 

CISA:       Govt. of Australia:        ABC:       Oodaloop:      ZDNet:    CNN:    Indian Express:    CP24:

You Might Also Read: 

Microsoft Will Invest $20Billion In Cyber Security:

 

« Cyber Revolution In The Media & Entertainment Industry
British Plan To Become A ‘Global Cyber Power’ In 2022 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Dome9

Dome9

Dome9 is a cloud firewall management service that stops vulnerabilities, secures remote access, and centralizes policy management.

tunCERT

tunCERT

TunCERT is the National Computer Emergency Response Team of Tunisia.

InAuth

InAuth

InAuth Security Platform delivers advanced device identification, risk detection, and analysis capabilities to help organizations limit risk and reduce fraud.

Bedrock Automation

Bedrock Automation

Bedrock Automation provides the world’s most powerful, scalable and cyber secure industrial control system (ICS).

Zeneth Technology Partners

Zeneth Technology Partners

Zeneth is a consulting firm providing information technology and cybersecurity services to federal and commercial clients.

ANIS

ANIS

ANIS represents the interests of Romanian IT companies and supports the development of the software and services industry.

Cyber Army Indonesia (CyberArmyID)

Cyber Army Indonesia (CyberArmyID)

Cyber Army Indonesia (CyberArmyID) is the first platform in Indonesia to collect and validate reports from hackers (referred to as Bug Hunter) regarding vulnerabilities that exist in an organization.

IBA Security

IBA Security

IBA Security is a center of competence consolidating the cybersecurity expertise of the IBA Group.

Cambridge Cybercrime Centre

Cambridge Cybercrime Centre

The Cambridge Cybercrime Centre is a multi-disciplinary initiative combining expertise from the Department of Computer Science and Technology, Institute of Criminology and Faculty of Law.

Next Horizon

Next Horizon

In the Next Horizon incubator, new disruptive models are being developed in Industry 4.0, Automated Driving and Internet-of-Things.

Business Hive Vilnius (BHV)

Business Hive Vilnius (BHV)

BHV is one of the oldest startup incubator and technology hubs in the Baltics, primarily focused on hardware, security, blockchain, AI, fintech and enterprise software.

HackHunter

HackHunter

HackHunter’s passive sensor network continuously monitors, detects and alerts when a malicious WiFi network and/or hacking behaviour is identified.

Haven Group

Haven Group

Haven Group and its companies are a cyber security one-stop-shop for our clients offering a full range of cyber security services to our clients in a unified and united way.

Focal Point

Focal Point

We aspire to be the focal point for Medium and Small size companies providing 24/7 cyber security advice, services and solutions.

Altospam

Altospam

Altospam is a full service corporate email protection, integrating multiple security levels for your emails.

Josef Ressel Centre for Intelligent & Secure Industrial Automation

Josef Ressel Centre for Intelligent & Secure Industrial Automation

The Josef Ressel Centre for Intelligent and Secure Industrial Automation investigates the fundamentals of digital assistants for industrial machines that enable intelligent and secure operation.