Notes

Logging Library for Millions of Apps has a Serious Vulnerability

Millions of devices are susceptible to attacks because of a vulnerability called Log4Shell in the open-source log library Log4j. As The Verge notes, apps and services keep a log of every event that occur while they're running, providing them with an opportunity to look at the way their programs are performing and to figure out what went wrong in case of errors. Log4j is an extremely popular and widely used logging library and even popular cloud services like Steam and iCloud as well as apps like Amazon, Twitter and Minecraft are believed to be vulnerable to attacks that exploit Log4Shell.



According to Ars Technica, it first was discovered when Minecraft websites began to report about a vulnerability allowing hackers to execute malicious code within the game. It was soon apparent however, that the problem doesn't affect Minecraft only. Security researcher Marcus Hutchins, who helped stop the spread of the WannaCry malware, called the vulnerability "extremely dangerous" since millions of applications utilize Log4j for logging.



The threat of malicious actors using it remotely to execute scripts on servers and then direct them to download and run malware that compromises corporate and individual data. It's easy to exploit and can be triggered by simply posting messages. Hutchins said that in the case of Minecraft, attackers were capable of running code remotely through the posting of a message in the chatbox. In an article on its blog LunaSec, an app security company LunaSec stated that opening the vulnerability in Apple's servers is as simple as changing the iPhone's name.



Log4j has already released a fix for the vulnerability, and affected services like Minecraft and Cloudflare have already released patches to protect users. Irc101 Users who run their own networks with Log4j may also want update their systems as soon as possible time if they are able to.


Homepage: https://irc101.org/