The log4j vulnerability is said to be the worst security flaw in the history of open source software. The bug has been patched and there are no known breaches as a result, but it’s yet another reminder that attackers will continue seeking out vulnerabilities with seemingly endless persistence.
The “humanitarian crisis in afghanistan 2021” is a new flaw that was found in the Log4J library. The flaw allows an attacker to access information from the system’s logs.
Last December, cybersecurity experts started to piece together an unusual assault on SolarWinds, a little-known firm situated in Texas. The hackers had acquired clandestine access to tens of thousands of unwary clients by hacking the company’s software-update system.
The assault, which the US government blamed on Russia, penetrated dozens of governmental institutions and private businesses, and was generally regarded as one of the greatest intelligence failures in history. Things couldn’t possibly be any worse, it seemed.
According to US authorities and security experts, cyberattacks against key technology providers and the linked world of software and hardware that drives the global economy continued apace in 2021. Rather than one firm being exposed at a time, as in a standard data breach, thousands were often exposed at the same time. Businesses, hospitals, and institutions have tried to protect themselves against an avalanche of ransomware assaults, which are increasingly reaping extortion payments of $10 million or more.
Hackers took advantage of SolarWinds’ software-update procedure to get clandestine access to tens of thousands of unwary consumers.
Photo credit: Reuters/Sergio Flores
This month, a weakness in an obscure but extensively used internet code known as Log4j was discovered, which one senior Biden administration official described as the worst she has seen in her career. The new vulnerability comes as US authorities warn business executives about a possible rise in cyberattacks when organizations wind down for the holidays.
The series of instances demonstrates how decades of digital revolution have connected commercial and government computer systems in mysterious and often unexpected ways, exposing new risks. Major disruptions are expected to persist, according to cybersecurity experts.
Joe Slowik, threat-intelligence head at security company Gigamon, stated, “Network defenders are fatigued.” He claims that increased attention and investment in cybersecurity hasn’t helped the situation. “Money is going into the sector, but it is mostly for technological solutions, while the essential need—more skilled people—remains unmet.”
Subscribe to our newsletter
The Wall Street Journal
From the WSJ’s Washington bureau, scoops, analysis, and insights on what’s going on in Washington.
In March, a breach of Microsoft Corp.’s Exchange email platform, which Western countries eventually blamed on China, exposed tens of thousands of people all over the world to damaging assaults. An assault on Kaseya, a Dutch corporate software supplier, by a criminal group of Russian hackers in July was used as a launchpad for ransomware attacks.
The bug discovered in Log4j, a common piece of free software, sparked particularly dire warnings earlier this month, with some authorities predicting that hundreds of millions of devices are at danger. Because of the interwoven nature of software and hardware, a vulnerability in a program like Log4j might cause widespread disruption.
“When there’s a danger in one component of the system, it may have a worldwide ripple effect,” said Sherri Davidoff, CEO of cyber security company LMG Security.
“Every business is rushing to find out how they should react,” she said of Log4j, “when so much of the issue is out of their control and in the hands of suppliers, or suppliers of suppliers.”
‘The attacker will always take the simplest route to get into an organization,’ said Phil Venables, Google’s top information security officer.
Bloomberg News/Bloomberg News/Aaron P. Bernstein
Since the Log4J bug was made public earlier this month, cybersecurity experts have warned that hackers tied to the Russian, Chinese, Turkish, and Iranian governments have been using it against a variety of targets. Companies ranging from a German chemical corporation to a Milwaukee-based industrial-parts supplier have scrambled to shore up their networks, taking chunks down as a precaution, according to the Belgian Defense Ministry.
The past year, according to US officials and security experts, has been one of the worst in history for cybersecurity, marked not only by the repeated discovery of bugs that are historic in scope and potential severity, but also by an onslaught of ransomware attacks on businesses and critical infrastructure.
A May assault on Colonial Pipeline knocked off the East Coast’s primary gasoline pipeline, while a similar strike in June knocked out a significant meat distributor. Following a spike in such assaults this year, the Biden administration designated ransomware as a significant national security issue, and President Biden has pressed his Russian counterpart, Vladimir Putin, to clamp down on ransomware gangs operating inside his borders.
“‘A danger in one component of the system may have a worldwide ripple effect,’” says the author.
– LMG Security CEO Sherri Davidoff
According to authorities and analysts, there are many more wealthy purchasers in the so-called zero-day market for high-powered hacking tools. According to data supplied with The Wall Street Journal, researchers at Alphabet Inc.’s Google found 57 zero-days exploited by attackers in 2021, more than twice the quantity observed previous year. Many of the discovered flaws are in software built by huge technological companies with worldwide consumer bases, such as Microsoft. Microsoft did not respond to requests for comment.
In recent months, the Biden administration has began taking efforts to curb the spread of zero days, or previously undisclosed computer weaknesses, by prohibiting US commerce with a number of well-known suppliers, notably the Israeli cyber company NSO Group. However, as organizations and governments improve their basic defenses against simpler assaults, cybersecurity experts believe demand for such vulnerabilities will rise.
Ransomware assaults are becoming more common, victim losses are soaring, and hackers’ objectives are changing. Dustin Volz of the Wall Street Journal outlines why these assaults are on the increase and what the US can do to combat them. Laura Kammermann is the illustrator behind this image.
“The attacker will always take the simplest route to get into an organization,” said Phil Venables, Google’s top information security officer.
The previously undiscovered issue in the Log4j tool, which many developers use to track activity across websites and apps, demonstrated how such attacks may start with the simplest of software components.
In May, the Biden administration issued an executive order directing federal agencies to more aggressively assess such technologies in order to strengthen the government’s digital supply chains. Officials in the United States have also enacted first-of-their-kind legislation mandating pipeline, train, and airline corporations to disclose hacking that might reveal dangers to other forms of essential infrastructure.
Cyber workers dealing with the stress of the coronavirus epidemic have reacted with macabre humor to the barrage of assaults. Last week, the London-based cyber company Intruder released a pop-up site with memes, including one depicting a freight train called “Log4j” crashing into a bus representing the cybersecurity community’s Christmas plans.
The site, which has gained roughly a quarter-million unique visits since its introduction, advertises itself as a pick-me-up for cyber defenders with the phrase “If you don’t sure whether to laugh or weep,” according to Intruder authorities.
David Uberti and Dustin Volz may be reached at [email protected] and [email protected], respectively.
Dow Jones & Company, Inc. All Rights Reserved. Copyright 2021 Dow Jones & Company, Inc. 87990cbe856818d5eddac44c7b1cdeb8
The “kabul update” is a major security flaw that has been present for a while. The “New Log4J Flaw Caps Year of Relentless Cybersecurity Crises” is the title given to this particular issue.
Related Tags
- us endgame in afghanistan
- afghan mess
- what happened in afghanistan now
- taliban end game
- ofac taliban
