Security experts are sounding the alarm over a newly discovered software vulnerability, and organisations have been advised to “urgently” check whether it leaves them exposed to hackers.
Alerts have been issued by the British and American governments as a growing number of hacking groups – potentially including spies and organised criminals – are exploiting the vulnerability to break into computer networks.
The British government said it was treating “this issue with the utmost seriousness” as the US warned the vulnerability was “being widely exploited by a growing set of threat actors”.
Researchers in the private sector said “the potential for damage is incalculable” with one describing the severity as: “The internet is on fire right now.”
What is the issue?
It is very rare for enterprise software to be completely written from the ground up for every different product.
Instead this software often depends on a shared library of open-source code maintained by charity organisations and distributed without any royalties.
COVID-19: New needle-phobia friendly coronavirus vaccine could protect against virus mutations
Online Safety Bill: MPs and Peers call for new offences to tackle ‘Wild West’ online
Rocket scientists and brain surgeons are no smarter than the rest of us, study finds
The new vulnerability has been discovered in one such bit of code.
Known as Log4j, the open-source tool is an Apache Software Foundation project and used almost ubiquitously in enterprise software products and cloud services.
It won’t directly impact people using personal devices, but any data they have with organisations that operate web servers could be at risk.
A fix has already been published by Apache – which described the vulnerability as “critical” – and large companies who control and update their own software should be able to quickly patch the vulnerability.
But because Log4j is so widely used as a logging utility there are likely to be thousands of companies exposed because the flaw affects third-party software which they cannot directly update.
Apache credited Chen Zhaojun, a security researcher at Chinese company Alibaba, for discovering and reporting the issue.
Who has been affected?
The first wave of victims were people playing the Microsoft-owned computer game Minecraft.
Hackers were able to post a short message in the Minecraft chatbox to remotely execute commands on the computers of other players.
Microsoft said it has patched the issue for Minecraft players and told customers they would be protected if they applied the fix.
The most obvious first wave of attacks all involved “cryptojacking”, when hackers hijack victim’s computers to use their processing power to mine cryptocurrencies.
Microsoft warned that alongside installing coin miners it had seen hackers exploiting the flaw to steal credentials and data from victim’s computers.
“The internet’s on fire right now. People are scrambling to patch and all kinds of people are scrambling to exploit it,” said Adam Meyers, senior vice president of intelligence at cyber security company Crowdstrike.
‘A very serious threat’
“I cannot overstate the seriousness of this threat,” warned Lotem Finkelstein, director of threat intelligence for Check Point Software Technologies.
Mr Finkelstein warned that the cryptojacking activity “creates just the sort of background noise that serious threat actors will try to exploit in order to attack a whole range of high value targets”.
Check Point has detected hundreds of thousands of attempts to exploit this vulnerability across more than a third of all corporate global networks.
“Security teams need to jump on this with utmost urgency as the potential for damage is incalculable,” Mr Finkelstein added.
