Posted on December 15, 2021 at 7:26 PM
Millions Of Devices At Risk Of Exploit To Log4j Zero-Day, CSIA Warns
A recent report has revealed that threat actors are exploiting a zero-day vulnerability that could affect millions of devices. The report reveals that the vulnerability is called Log4j, a Java library used to record error messages in applications. It’s also utilized for any device that uses versions 2.0 to 2.14.1 when they are connected to the internet.
Different devices and products utilize Log4j, such as the Java version of the widely known game Minecraft. Additionally, Steam, a PC gaming service also makes use of the Log4j, while Mac, iPad, and iPhone owners depend on the program to store important data.
The Department of Homeland Security also warned that the vulnerability, which is used by large corporations, can be easily exploited by threat actors.
And recently, the Cybersecurity and Infrastructure Security Agency (CSIA) released an official statement, issuing a warning to the general population about the vulnerability.
The agency has also informed non-federal partners to quickly remediate or provide a patch to the bug before they are exploited by threat actors.
Easterly has also warned software and hardware vendors to make it a priority to find a patch for the bug, which is already being exploited by threat actors.
Some of the bad actors, according to the agency have developed software that independently searches for compromised systems and automatically delivers malware, similar to the activities surrounding last year’s SolarWinds attacks.
The Vulnerability Is Easy To Exploit
As noted by the CSIA, the Log4j vulnerability is very easy to exploit. The hacker doesn’t need any serious technical skills or any special software. All they need is to deliver a string of malicious code, which can be easily logged by Log4j. Afterward, the threat actor can assume total control of the server.
Some people have already discovered creative strategies they can use to launch the exploit, especially some Minecraft players that have been doing so with the in-game chat system.
Additionally, Twitter users have started changing their usernames to strings that could set off the exploit. The report also discovered that an email could set it off as well.
The agency has stressed that the exploit is pretty bad not because of its impact on systems but due to the level of ease even a non-technical person can use. Additionally, the fact that security researchers have not been able to come up with a fix makes it more dangerous for users.
But the only catch here is the fact that security researchers are seriously working hard to provide a patch to the bug. For example, Apache has already released a patch for Log4j that can show how the exploit usage can spread. However, this only works with the modern versions of Java.
The average internet user with little technical skills will be at more risk of being targeted, as they cannot do much to protect themselves from the exploit.
The best thing users can do is to be current with the latest news related to the exploit and follow the mitigation instructions from network admins and software companies.
Both government and privately-owned cybersecurity experts are seriously working to find the best solution to stop these exploits, according to CSIA. The agency noted that preventing the occurrence of such vulnerability in the future is the best way to avoid risking exploitations that could be damaging to individual systems and corporate networks.
One Of The Worst Security Threats In Many Years
CSIA director Jen Easterly stated that organizations should be aware of the risk of vulnerability and how threat actors can pounce on the bug to launch attacks.
“We are taking urgent action to drive mitigation of this vulnerability and detect any associated threat activity,” he noted, adding that the bug has been included in the agency’s catalog of known exploited vulnerabilities.
The Log4j bug can be exploited to steal sensitive information such as usernames and passwords. It can also be used to install dangerous malware on infected devices, according to Easterly. She added that the bug is a big challenge to network defenders due to its broad use.
Easterly has handled various federal cybersecurity roles for the past 20 years. She admitted that the Log4j vulnerability represents one of the worst threats she has seen throughout her years in the sector. Easterly says she expects the vulnerability to be exploited by sophisticated threat actors and there is a need to take important steps to mitigate the damaging impacts of their exploits.
