New Delhi, December 11, 2011 : .Many popular services such as Apple iCloud and Amazon are at risk from a ‘ubiquitous zero-day attack, cybersecurity researchers warned.
This has left IT security personnel at many companies scrambling for a fix called ‘Log4Shell.
The ‘zero-day’ exploit (which is a cyber attack targeting a software vulnerability which is unknown to the software/antivirus companies) is found in the widely-used Java logging system called ‘log4j2’.
If exploited, the vulnerability allows remote code execution (RCE) on vulnerable servers, giving hackers the ability to import malware that would completely compromise millions of machines.
This exploit is possible for many, many services.Researchers from LunaSec, an application security firm, found that cloud services such as Steam and Apple iCloud are vulnerable.
“Anybody using Apache Struts is likely vulnerable.We’ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach,” the researchers noted in a blog post late on Friday.
Many Open Source projects like the Minecraft server, Paper, have already begun patching their usage of ‘log4j2’.
TechCrunch reports that Apple, Amazon and Cloudflare are the most vulnerable companies to the ‘Log4Shell attack.They include Twitter, Steam, Baidu NetEase Tencent, Tencent, Elastic, Steam, Steam, Baidu, Amazon, Cloudflare, Twitter and Steam.
However, there may be hundreds, if not thousands, of others affected.
In a statement, Cloudflare said it has updated systems to prevent attacks, adding that it saw no evidence of exploitation.
“The Log4j vulnerability is a significant threat for exploitation due to the widespread inclusion in software frameworks, even NSA’s GHIDRA,” said Robert Joyce, the director of Cybersecurity at the US National Security Agency (NSA).
GHIDRA, a reverse engineering tool that is free and open-source by the agency, was created.
The Computer Emergency Response Team (CERT) for New Zealand, Deutsche Telekom’s CERT, and the Greynoise web monitoring service have also warned that hackers are actively looking for servers vulnerable to ‘Log4Shell’ attacks.
The Apache Software Foundation has also released an emergency security update to patch the zero-day vulnerability in ‘log4j’.
na/ksk/
#Threat #Apple #iCloud #Delhi #Delhi #New Delhi #Amazon #Twitter #Cybersecurity #Cloud # Java #Cloudflare #Data Breach #Cyber Attack #ICloud
.
