TIMES.KY

Cayman Islands, Caribbeanand International News
Tuesday, Mar 28, 2023

Log4j software flaw 'endemic,' new cyber safety panel says

Log4j software flaw 'endemic,' new cyber safety panel says

A computer vulnerability discovered last year in a ubiquitous piece of software is an “endemic” problem that will pose security risks for potentially a decade or more, according to a new cybersecurity panel created by President Joe Biden.
The Cyber Safety Review Board said in a report Thursday that while there hasn’t been sign of any major cyberattack due to the Log4j flaw, it will still “be exploited for years to come.”

“Log4j is one of the most serious software vulnerabilities in history,” the board’s chairman, Department of Homeland Security Under Secretary Rob Silvers, told reporters Wednesday.

The Log4j flaw, made public late last year, lets internet-based attackers easily seize control of everything from industrial control systems to web servers and consumer electronics. The first obvious signs of the flaw’s exploitation appeared in Minecraft, a hugely popular online game owned by Microsoft.

The flaw’s discovery prompted urgent warnings by government officials and massive efforts by cybersecurity professionals to patch vulnerable systems.

The board said Thursday that “somewhat surprisingly” the exploitation of the Log4j bug had occurred at lower levels than experts predicted. The board also said that it was unaware of any “significant” Log4j attacks on critical infrastructure systems but noted that some cyberattacks go unreported.

The board said future attacks are likely in large part because Log4j is routinely embedded with other software and can be hard for organizations to find running in their systems.

“This event is not over,” Silvers said.

Log4j, written in the Java programming language, logs user activity on computers. Developed and maintained by a handful of volunteers under the auspices of the open-source Apache Software Foundation, it is extremely popular with commercial software developers.

A security researcher at the Chinese tech giant Alibaba notified the foundation on Nov. 24. It took two weeks to develop and release a fix. Chinese media reported that the government punished Alibaba for not reporting the flaw earlier to state officials.

The board said Thursday it found “troubling elements” with the Chinese government’s policy toward vulnerability disclosures, saying it could give Chinese state hackers an early look at computer flaws they could use for nefarious means like stealing trade secrets or spying on dissidents. The Chinese government has long denied wrongdoing in cyberspace and told the board that it encourages improved information sharing on software vulnerabilities.

The board offered a number of recommendations on mitigating the fallout of the Log4j flaw as well as improving cybersecurity generally. That includes the suggestion that universities and community colleges make cybersecurity training a required part of computer science degree and certification programs.

The Cyber Safety Review Board is modeled after the National Transportation Safety Board, which reviews plane crashes and other major accidents, and was mandated by an executive order Biden signed last May. The 15-member board is made up of FBI, National Security Agency and other government officials as well as people from the private sector. Some supporters of the new board criticized DHS for taking so long to get it up and running.

Biden’s executive order directed the board to conduct its first review on the massive Russian cyber espionage campaign known as SolarWinds. Russian hackers were able to breach several federal agencies, including accounts belonging to top cybersecurity officials at DHS, though the full fallout from that campaign is still unclear.

Silvers said DHS and the White House agreed that reviewing the Log4j flaw was a better use of the new board’s expertise and time.
Newsletter

Related Articles

TIMES.KY
Close
0:00
0:00
Brand new security footage has just been released to the public showing the Active shooter Audrey Elizabeth Hale drove to Covenant Church School in her Honda Fit this morning, parked, and shot her way into the building
AMERICA, 2023
U.S. charges FTX's Bankman-Fried with paying $40 million bribe
Fallen 'Crypto King' Who Owes Millions to Investors Was Kidnapped and Tortured
Regulators blame social media for SVB's rapid collapse: 'Complete game changer'
AOC explains why she opposes banning TikTok
UK: Humza Yousaf replaces Nicola Sturgeon as SNP leader and first minister in Scotland
In a dramatic U-turn against His Government: Judicial Reform Legislation Must Be Halted, Says Israeli Defense Minister Yoav Gallant
Gordon Moore, a co-founder of Intel Corporation, died at 94
Powell: Silicon Valley Bank was an 'outlier'
Donald Trump arrested – Twitter goes wild with doctored pictures
NYPD is setting up barricades outside Manhattan Criminal Court ahead of Trump arrest.
Credit Suisse's Scandalous History Resulted in an Obvious Collapse - It's time for regulators who fail to do their job to be held accountable and serve as an example by being behind bars.
Home Secretary Suella Braverman tours potential migrant housing in Rwanda as asylum deal remains mired in legal challenges
Paris Rioting vs Macron anti democratic law
'Sexual Fantasy' Assignment At US School Outrages Parents
Credit Suisse to borrow $54 billion from Swiss central bank
Russian Hackers Preparing New Cyber Assault Against Ukraine
Jeremy Hunt insists his Budget will get young parents and over-50s back into work
If this was in Tehran, Moscow or Hong Kong
TRUMP: "Standing before you today, I am the only candidate who can make this promise: I will prevent World War III."
Mexican President Claims Mexico is Safer than the U.S.
A brief banking situation report
Lady bites police officer and gets instantly reaction
We are witnessing widespread bank fails and the president just gave a 5 min speech then walked off camera.
Donald Trump's asked by Tucker Carlson question on if the U.S. should support regime change in Russia?.
Silicon Valley Bank exec was Lehman Brothers CFO
In a potential last-ditch effort, HSBC is considering a rescue deal to save Silicon Valley Bank UK from insolvency
BBC Director General, Tim Davie, has apologized, but not resigned, yet, following the disruption of sports programmes over the weekend
Elon Musk Is Planning To Build A Town In Texas For His Employees
The Silicon Valley Bank’s collapse effect is spreading around the world, affecting startup companies across the globe
City officials in Berlin announced on Thursday that all swimmers at public pools will soon be allowed to swim topless
Fitness scam
Market Chaos as USDC Loses Peg to USD after $3.3 Billion Reserves Held by Silicon Valley Bank Closed.
Senator Tom Cotton: If the Mexican Government Won’t Stop Cartels from Killing Americans, Then U.S. Government Should
Banking regulators close SVB, the largest bank failure since the financial crisis
The unelected UK Prime Minister Rishi Sunak, an immigrant himself, defends new controversial crackdown on illegal migration
Man’s penis amputated by mistake after he’s wrongly diagnosed with a tumour
In a major snub to Downing Street's Silicon Valley dreams, UK chip giant Arm has dealt a serious blow to the government's economic strategy by opting for a US listing
It's the question on everyone's lips: could a four-day workweek be the future of employment?
Is Gold the Ultimate Safe Haven Asset in Times of Uncertainty?
Spain officials quit over trains that were too wide for tunnels...
Don Lemon, a CNN anchor, has provided a list of five areas that he believes the black community needs to address.
Hello. Here is our news digest from London.
Corruption and Influence Buying Uncovered in International Mainstream Media: Investigation Reveals Growing Disinformation Mercenaries
Givenchy Store in New York Robbed of $50,000 in Merchandise
European MP Clare Daly condemns US attack on Nord Stream
Former U.S. President Carter will spend his remaining time at home and receive hospice care instead of medication
Tucker Carlson called Trump a 'demonic force'
US Joins 15 NATO Nations in Largest Space Data Collection Initiative in History
×