Yesterday, the agency had a phone briefing with “critical infrastructure stakeholders” about the flaw. As a refresher, a string processing vulnerability in Apache’s Log4J logging package—included in dozens of other huge software packages and used on hundreds of thousands if not millions of machines worldwide—allows a remote user with a carefully-crafted input string to gain full remote code execution on the vulnerable system without any credentials required whatsoever.
Obviously that’s pretty much the absolute worst-case scenario for a security flaw, and the severity of the vulnerability combined with the widely-used nature of the vulnerable package makes this a real five-alarm fire. In fact, the director of CISA says that it is “one of the most serious [she] has seen in [her] entire career, if not the most serious.”
Remarkably, even though this flaw existed in Log4J since 2013, there’s no evidence that it has been actively exploited until December 1 of this year, and according to Apache, there’s also no evidence that it was being exploited on a large scale until after public disclosure. Now, however, more than 1.2 million attacks targeting the flaw have already been recorded by security researchers.
Financial Times reports Check Point as commenting that almost half of the attacks have been performed by known cyber-attackers who are using the vulnerability to spread malware. Meanwhile, SentinelOne and Mandiant have apparently both commented that Chinese state-sponsored cybercriminals are actively exploiting the flaw. Still other groups are using the flaw to mine crytocurrency on the exploited systems, particularly Monero.
As severe as the Log4J vulnerability is, most desktop users don’t really have to worry about their own systems. The concern is primarily for web-facing servers hosting internet services. If you’re a sysadmin, you’re almost certainly already patching your systems, but just in case, it might not be a bad idea to go ahead and poke all your software to have it check for updates.