Recently, U.S. administration cyber officials warned that hundreds of millions of devices around the globe could be exposed to a newly revealed software vulnerability.
The said vulnerability has been found on Java-based software Log4j that large firms use to log information of their applications. Tech giants like AWS and IBM have moved to address the bug in their products.
The Department of Homeland Security has ordered federal civilian agencies to update their software. Jen Easterly, the head of the agency, warned that the vulnerability was being widely exploited by a growing set of hackers, reported CNN. Some experts said that it could take weeks to solve the situation and that suspected Chinese hackers are already attempting to exploit it.
The vulnerability offers an easy way to access an organization's computer server for hackers. Using which the attacker can easily devise other ways to access systems on an organization's network. A security fix has been released by the Apache Software Foundation, which manages the Log4j software.
The hack was in the wild at least 9 days before publicly disclosed said cybersecurity firm Cloudflare. Hackers linked with Chinese government have already begun using the vulnerability, said Charles Carmakal, chief technology officer for cybersecurity firm Mandiant. However, Mandiant did not elaborate on what organizations the hackers were targeting.
![]()
US Cybersecurity and Infrastructure Security Agency (CISA) said it is setting up a public website where it will update information on what software products were affected by the vulnerability as well as the techniques that hackers have been using to exploit it. "This will be a multiweek process where new actors are exploiting the vulnerability," Eric Goldstein, executive assistant director at CISA said.
CISA said that vulnerability is more serious because all kinds of attackers can exploit it, from cryptominers to ransomware groups and beyond. Though no evidence of an active supply-chain attack has surfaced till now. According to Goldstein, there’s no single action that fixes this issue, and that it would be a mistake to think that anyone is going to be done with this in a week or two.