Here's Why The Log4j Security Vulnerability Has CISA Pressing The Panic Button
Even if you're from the U.S., you may not have heard of CISA. The Cybersecurity and Infrastructure Security Agency is part of the Department of Homeland Security, and it primarily handles technological threats to the nation. Well, CISA is still in the process of an all-hands red alert thanks to the Log4shell security vulnerability in Apache's Log4J package that we told you about on Saturday.
Yesterday, the agency had a phone briefing with "critical infrastructure stakeholders" about the flaw. As a refresher, a string processing vulnerability in Apache's Log4J logging package—included in dozens of other huge software packages and used on hundreds of thousands if not millions of machines worldwide—allows a remote user with a carefully-crafted input string to gain full remote code execution on the vulnerable system without any credentials required whatsoever.
Obviously that's pretty much the absolute worst-case scenario for a security flaw, and the severity of the vulnerability combined with the widely-used nature of the vulnerable package makes this a real five-alarm fire. In fact, the director of CISA says that it is "one of the most serious [she] has seen in [her] entire career, if not the most serious."
Financial Times reports Check Point as commenting that almost half of the attacks have been performed by known cyber-attackers who are using the vulnerability to spread malware. Meanwhile, SentinelOne and Mandiant have apparently both commented that Chinese state-sponsored cybercriminals are actively exploiting the flaw. Still other groups are using the flaw to mine crytocurrency on the exploited systems, particularly Monero.
As severe as the Log4J vulnerability is, most desktop users don't really have to worry about their own systems. The concern is primarily for web-facing servers hosting internet services. If you're a sysadmin, you're almost certainly already patching your systems, but just in case, it might not be a bad idea to go ahead and poke all your software to have it check for updates.
