The critical Log4Shell vulnerability, which was discovered
last week, has the potential to infect millions of computers around the world.
According to information security experts interviewed by Gazeta.Ru, this
vulnerability is present in many services and applications, and with its help
hackers can carry out attacks on banks, large companies and supply chains. techqueer
WannaCry May Repeat
A new critical vulnerability Log4Shell could become the most
serious cyber threat in recent years, writes the portal ArsTechnica.
Reportedly, the vulnerability was assigned the highest,
tenth, severity rating.
Log4Shell was discovered last week and caused thousands of
Minecraft servers to crash. The source of the vulnerability is in the logging
utility Log4J, which is used by millions of different services and
applications.
Also, according to
the portal, one of the largest providers of HR solutions, Kronos, reported a
ransomware attack that shut down the company's systems for several weeks. The
company itself did not comment on whether the new vulnerability was exploited
by the hackers. However, the portal's journalists are confident that the attack
was carried out using Log4Shell.
According to Pavel Korostelev, head of product promotion at
Security Code, this vulnerability can be compared to the exploit that was at
the heart of WannaCry.
“As soon as malicious code is added to this vulnerability,
which, for example, encrypts data, then problems will begin,” the expert said.
He also noted in an interview with Gazeta.Ru that the
vulnerability can be used in an attack on supply chains.
“The library in which we found Log4Shell is extremely widely
used in systems and products from various manufacturers. Among the victims are
Apple , Amazon , CloudFlare, Google , LinkedIn, solutions from Cisco , Oracle ,
RedHat and other large companies are vulnerable, ”said Mikhail Larin , head of
the monitoring group of the Jet CSIRT information security monitoring and
response center, Jet Infosystems .
The head of the Avast Malware Research Department, Jakub
Krustek, also noted the high level of danger from the "hole" in
Log4Shell.
“The attack is carried out very quickly, since
cybercriminals can exploit this vulnerability by simply sending a certain line
of text to the chat window of the vulnerable application,” Krustok told
Gazeta.Ru.
Attackers are then able to remotely execute code on the
infected device or server. They can upload malware there, steal information, or
use it for their own purposes.
Millions of users at risk
“At first glance, it appears that the vulnerability is aimed
at mining, but we believe that this is only necessary to confuse security
researchers. We are confident that attackers will try to use this cover to
attack other, more important targets: banks; bodies responsible for state
security; a different critical infrastructure, ”says Lotem Finkelsteen, Head of
Threat Intelligence at Check Point Software Technologies.
In just a few days, Check Point Software Technologies
prevented more than 820,000 attempts to exploit the vulnerability, he said.
“More than 46% of them were undertaken by well-known cyber
groups, and this is worrisome. So far, we have seen attempts to exploit
vulnerabilities in more than 36.8% of corporate networks around the world,
”said Finkelsteen.
According to the company, new variants of the original
exploit appear very quickly - over 60 in less than 24 hours.
“The potential for damage is incalculable. The requirement
for a quick response is emphasized by the fact that the vulnerability was discovered
at the end of the working week on the eve of the vacation season, when
information security specialists can react more slowly to incidents, ”the
expert emphasized.
According to Anton Ponomarev , director of ESET's corporate
business department , millions of users can become victims.
“There are many scenarios of damage to end users - from
stopping a favorite service to stealing personal data and taking control of
personal devices,” the expert concluded.
The vulnerability affects Java-based applications and
servers that use the Log4j library. It allows you to register a specific string
in your internal systems. At the same time, according to Ponomarev, software
that is not connected to the Internet can also be vulnerable, since data is
transferred from system to system.
techdirtblog slashdotblog justhealthguide healthandblog supercomputerworld
