‘Internet’s on Fire Right Now’: Millions of Devices at Risk Over New Software Vulnerability

Contact Your Elected Officials
The Epoch Times Header

A newly discovered flaw in a common piece of open-source software is prompting researchers and companies to update their systems in a bid to prevent hacks and ransomware attacks.

The vulnerability, known as CVE-2021-44228, was disclosed on Dec. 9, which allows remote access to servers and code execution, some experts have said. Meanwhile, Log4j is used in a large number of enterprise systems, raising concerns that it may be easily exploited.

Since the vulnerability, which some dubbed “Log4Shell,” so is widespread and is likely present in highly-trafficked websites and apps, users may also see their favorite websites and apps be impacted.

Cybersecurity firms Mandiant and Crowdstrike said that hacking groups are trying to breach systems, and Mandiant described to Reuters that they are “Chinese government actors,” in reference to the ruling Chinese Communist Party.

“Given that Log4j has been a ubiquitous logging solution for Enterprise Java development for decades, Log4j has the potential to become a vulnerability that will persist within Industrial Control Systems (ICS) environments for years to come,” according to a blog post by cybersecurity researchers at Dragos.

A cybercriminal can exploit the flaw by sending a malicious code string that will get logged by the Log4j version, allowing the attacker to load an arbitrary Java code to a server. The vulnerability could potentially allow them to take control of the server.

Federal cybersecurity officials also reportedly expressed alarm over the vulnerability in recent days.

“This vulnerability is one of the most serious that I’ve seen in my entire career, if not the most serious,” Jen Easterly, the head of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), said on a phone call. The Epoch Times has contacted CISA for comment.

Easterly warned that CISA can “expect the vulnerability to be widely exploited by sophisticated actors and we have limited time to take necessary steps in order to reduce the likelihood of damaging incidents.”

The proverbial canary in the coal mine was when researchers noted that Minecraft’s servers could be compromised via the vulnerability. Microsoft last week posted instructions for how players could update the game’s Java version.

“This exploit affects many services—including Minecraft Java Edition,” said Microsoft. “This vulnerability poses a potential risk of your computer being compromised.”

In another stark warning, Cloudflare CEO Matthew Prince wrote Friday that his firm has “made the determination that Log4J is so bad we’re going to try and roll out at least some protection for all Cloudflare customers by default, even free customers who do not have our [enterprise suite]. Working on how to do that safely now.”

“It’s a design failure of catastrophic proportions,” Free Wortley, the CEO of the open-source data security platform LunaSec, wrote on its website last week.

Elaborating on what services could be targeted via the exploit, Wortley said that “Cloud services like Steam, Apple iCloud, and apps like Minecraft” have been discovered to be vulnerable. “Anybody using Apache Struts is likely vulnerable. We’ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach,” he said, referring to the hack that released millions of people’s credit data.

Last week, CISA issued an alert over the vulnerability, as did Australia’s cybersecurity agency. The Apache Software Foundation rates the vulnerability as “critical” and published ways to deal with it on Friday.

“The internet’s on fire right now,” warned Adam Meyers, a senior vice president with Crowdstrike. “People are scrambling to patch,” he told The Associated Press, “and all kinds of people scrambling to exploit it.”

By Jack Phillips

Read Original Article on TheEpochTimes.com

The Epoch Times
The Epoch Timeshttps://www.theepochtimes.com/
Tired of biased news? The Epoch Times is truthful, factual news that other media outlets don't report. No spin. No agenda. Just honest journalism like it used to be.

Remember Epstein’s “Little Black Books”?

Image of Bill Clinton getting a massage from Jeffrey...

On the Major League’s periphery: A major trip through the minors

For Nick Dunn, the trek through the minors is a trifecta of physical, mental, and organizational hurdles filled with politics, roster volatility, and injuries.

Private Citizens are Now Looking into Epstein Client List

Most Americans have never felt so betrayed and confused by a president and his admin as they are by the Trump admin over the Epstein client list issue.

Peace In Ukraine Won’t End The West’s Hybrid War On Russia

The West’s Hybrid War on Russia to follow peace in Ukraine is inevitable due to neoconservatives and liberal-globalists in its decision-making ecosystem.

Epstein Case Closed?

The DOJ and FBI announced on Sunday evening of the July 4th holiday weekend that Jeffry Epstein had no client list and didn’t kill himself in prison.

Federal Judge Blocks Trump’s Birthright Citizenship Order After Supreme Court Ruling

Judge barred Trump admin from enforcing EO limiting birthright citizenship, after Supreme Court restricted judges from issuing nationwide injunctions.

California Might Stop Making Necessary Debt Payments for 2 Years

California State Legislature met the budget submission deadline and it was signed by the governor, but they still need to cut $12 billion in spending.

MP Materials Secures Rare Earths Deal With DOD, Shares Surge 50 Percent

MP Materials Corp. announced a public-private partnership with the DOD to build out rare earth magnet supply chain and reduce dependency on China.

Ex-CIA Director Brennan Says DOJ Hasn’t Contacted Him About an Investigation

Former CIA Dir Brennan said he hasn't been contacted by DOJ, FBI, or CIA following reports he and former FBI Dir. Comey are under investigation.

RFK Jr. Bans Illegal Immigrants From Government-Funded Programs

HHS Sec. Robert F. Kennedy Jr. is rescinding a 1998 interpretation of a law that allowed illegal immigrants to access certain government-funded programs.

Rubio Set to Visit Malaysia for ASEAN Meetings Amid Tariff Tensions

A delegation including U.S. Sec. of State Marco Rubio will travel to Kuala Lumpur, Malaysia, for series of high-profile meetings between July 11 and 12.

US Will Collect More Than $300 Billion in Tariff Revenues This Year, Treasury Secretary Says

U.S. is on track to potentially raise “well over $300 billion” in tariff income by end of the year, Treasury Sec. Scott Bessent said during WH Cabinet meeting.

Senate Panel Advances Trump’s CDC Director Nominee

A Senate committee on July 9 voted to advance the nomination of Susan Monarez to lead the Centers for Disease Control and Prevention (CDC).
spot_img

Related Articles