Notes

Logging Library for Millions of Apps is a Serious Vulnerability

A flaw known as Log4Shell discovered in the open-source log library Log4j exposes millions of devices vulnerable to attacks. Plussoc The Verge points out that applications and services keep track of all events while they run, giving them the ability to analyze the performance of their programs and to discover the reason for the error in the event of errors. Log4j happens to be an extremely popular and widely used logging library, and even popular cloud services such as Steam and iCloud as well as applications like Amazon, Twitter and Minecraft are believed to be vulnerable to attacks exploiting Log4Shell.



According to Ars Technica, it first was discovered when Minecraft websites began to report about a vulnerability allowing hackers to execute malicious code in the game. It was soon apparent, though, that the problem doesn't affect Minecraft only. Marcus Hutchins, a security researcher who stopped the spread from WannaCry malware identified the vulnerability as "extremely serious" because millions of applications utilize Log4j to log.



The threat of malicious actors using it remotely to execute scripts on servers and then direct them to download and execute malware that compromises the data of companies and individuals. Additionally, it's quite easy to exploit and can be triggered by posting messages. Hutchins stated that in the case of Minecraft the attackers were able to execute code remotely through the posting of a message in the chatbox. LunaSec, an app security company stated that triggering the vulnerability in Apple's server's servers is done by simply changing an iPhone's name.



Log4j has already released an update for the vulnerability and affected services such as Minecraft and Cloudflare have already rolled out patches to safeguard users. Log4j users who manage their own networks may need to update their systems as soon as possible if possible.


Homepage: https://plussoc.com/