Two weeks ago the information technology world was put on alert by a zero-day vulnerability called Log4Shell. In the coming weeks and months this vulnerability could lead to one of the biggest cyberattacks.
The vulnerability was found in the open-source Log4j. Log4j is a piece of software that records errors and routine system operations in the software it is used in and reports them to system administrators and users.
The IT world first learned of this vulnerability on 9 December 2021. The impact it could have and the ease with which it can be exploited led the US National Vulnerability Database to give it the highest security rating, critical.
According to ZDNET, a technology news site, cybercriminals who learned of the vulnerability immediately launched a very large number of attacks to exploit it. According to Microsoft, numerous state-backed cybercrime groups it tracks also began exploiting the vulnerability. These groups, which included cybercriminals from Turkey, came from countries such as China, Iran and North Korea.
As soon as the vulnerability came to light, the Apache Software Foundation, the developer of Log4j, made a fix to Log4j’s code and released it on 10 December 2021. It later emerged, however, that this fix did not fully eliminate the vulnerability, and on 13 December 2021 a new version of Log4j was released to users. This second vulnerability was also rated critical by the US National Vulnerability Database. Because the vulnerability had still not been fully eliminated despite these two updates, a further update was released on 17 December 2021. Although this last vulnerability was not as serious as the first two, it was rated “high”, a level considered serious in the cybersecurity world.
Log4j is used today in many applications, servers and internet-facing devices. This shows that fixing these vulnerabilities will take considerable time.
Santiago Torres-Arias of Purdue University points to two fundamental problems that make the vulnerability difficult to fix.
The first is that Log4j is not a stand-alone piece of software but a software component. To find out where this component is running, system administrators have to go through their software line by line to determine whether Log4j is being used. Responding to cyberattacks in an environment where you do not know what you are protecting is very difficult.
The second major problem is this: it takes companies that use Log4j in their software a long time to resolve the problems associated with it. Because Log4j is, by its nature, part of the software supply chain. In other words, while a piece of software is being developed it has to pass the approval of many departments before the final product emerges. If a problem with the software is detected in one of these departments, the faulty software is corrected before it is handed over to the next department.
But Log4j is used in so many different software products that even a single update requires the approval of the Log4j developer, the software developer and many others. This delays the fixing of the vulnerability and can even lead to it being ignored.
However time-consuming and difficult it may seem, what we need to do against Log4j and software like it is to apply software updates, one of the most important protective shields in cybersecurity, as quickly as possible once they are available.
