Notes

The Log4j Security Flaw Could Impact the Internet in General Here's what you Need to Know

"It will take years to address this issue, while attackers will be watching... on every day [to attack itfor vulnerabilities]," said David Kennedy CEO of cybersecurity firm TrustedSec. "This is a ticking time bomb for companies."



Here's the information you should know:



What is Log4j? And why is it important?



Log4j is one of the most popular logging libraries online, according to cybersecurity experts. Log4j offers software developers a way to build a record of activity to be used to serve a variety of functions for auditing, troubleshooting and data tracking. Since it is free and open-source it can be used to access every part of the internet.



"It's ubiquitous. Even if you don't use Log4j directly as developer, you may still be running vulnerable code because the open source library that you use relies on Log4j," Chris Eng of cybersecurity firm Veracode told CNN Business. This is the nature software: It's turtles all down.



The software is used by companies such as Apple, IBM and Oracle, Cisco, Google, Amazon and Cisco. It could present in popular websites and apps, and hundreds of millions of devices that use these services could be vulnerable to security vulnerabilities.



Are hackers exploiting it?
cranial cavity


According to cybersecurity firm Cloudflare the attackers are believed to have had more time than a week to exploit the software flaw before it was disclosed. Now, with the number of hacking attempts occurring every day, many are worried the worst is yet be yet to come.



"Sophisticated threat agents will figure out a way to really weaponize vulnerabilities to maximize gains," Mark Ostrowski (Check Point's head engineer) said Tuesday.



Late on Tuesday night, Microsoft said in an update to a blog post that state-backed hackers from China, Iran, North Korea and Turkey have tried to exploit the Log4j flaw.



Why is this security flaw so dangerous?



Experts are particularly worried about the vulnerability due to the fact that hackers could gain easy access to a company’s computer server, giving them access to other components of the network. Kennedy says it's difficult to identify the vulnerability and determine if a computer is already compromised.



A second vulnerability was also discovered in Log4j's software late on Tuesday. Apache Software Foundation, a nonprofit that developed Log4j and other open software, has released an update to security for businesses to apply.



What are the strategies employed by companies to tackle this issue?



Last week, Minecraft published a blog post that announced a flaw was discovered in a particular version of its game. It quickly released the fix. Other companies have followed similar steps.



US warns hundreds of millions of devices that are at the risk of a new software vulnerability



Customers have received advisories from IBM, Oracle, AWS, Cloudflare, and AWS. Some push security updates, while others detail their plans for future patches.



"This is a major bug, but you cannot hit the button to fix it as the typical major vulnerability." Kennedy said it would require a lot of work and time.



CISA stated that it would create a website for the public to provide updates on software products affected by the vulnerability.



What can you do to ensure your security?



The pressure is largely on businesses to take action. Users should make sure that they update their software, apps and devices whenever they are prompted by companies in the coming days or weeks.



What's next?



The US government has warned affected businesses to be on guard for cyberattacks and ransomware during the holidays.



There is concern that malicious actors may exploit the vulnerability in innovative ways. While large tech companies might have security teams in place to deal with these potential threats however, many other companies don't.



"What I'm most concerned about is schools, the hospitals those places where there's only one IT person in charge of security, but doesn't have the time or the budget or tooling," said Katie Nickels, Director of Intelligence at cybersecurity firm Red Canary. "Those are the organizations that I am most worried about -- the small businesses with low security budgets.


Here's my website: https://cranialcavity.net/