Rob Wright: Hi, I'm Rob Wright security news
director at Tech Target. And I am here with
security news writer Alex Culafi. Alex, welcome.
Thanks, Rob. We're here today to discuss
Log4Shell, a critical vulnerability and a popular
open-source software package. It's causing a lot
of concern in the InfoSec industry. If you want to
learn more about log for Shell and the latest
goings-on, you can check out our landing page on
Tech Target news. Let's get into it. Alex, why is
this so concerning for the InfoSec industry?
Alexander Culafi: So Log4Shell is a 10 in the
common vulnerability scoring system, which I won't
explain, but it is the industry standard for how
bad a vulnerability is, and 10 is the highest
score, you can get the worst of the worst. But
this one's uniquely bad. Because it's a remote
code execution vulnerability. That one is
ubiquitous. This Java logging framework is in
cloud applications. It's in noncloud applications,
it's in iCloud, it's in Minecraft, it's in SMBs
enterprises, and it's everywhere. In fact, many
companies not only utilize their own instance of
Log4J, but they'll also use, let's say something
on their back end that also utilizes its own
instance of Log4J. So very ubiquitous. But also
it's hard to patch, not just because of the
reasons I just described, but also Log4J 2 has
been going since 2014, the whole framework for the
last 20 years. And because of that some of the
engineers who are at companies now weren't there
when Log4J was onboarded and making it very
complicated. And then the last reason is that it's
very easy to exploit. It only takes a single
string of malicious code in the log files of a
vulnerable server to completely exploit this, my
favorite line comes from checkpoint research. They
just did an FAQ where they said even a
six-year-old could exploit it.
Rob Wright: Let's hope my six-year-old doesn't get
into this then. So what is the latest on the
exploitation of Log4Shell? Are we seeing attacks?
And if so how many?
Alexander Culafi: We're definitely seeing attacks.
One of the things that's so interesting about
this, in fact, is when a major vulnerability comes
out, usually, it takes a little time for it to
ramp up. But this was disclosed I think, December
9, and we were seeing news of exploitation and
mass exploitation, within hours and a couple of
days. I talked to Cloudflare CTO, Joe Sullivan, he
told me Monday I believe that they were seeing a
million exploit attempts that they were blocking
Cloudflare as a cloud security vendor, an hour,
and then their
Rob Wright: In an hour. Wow.
Alexander Culafi: And their CEO, Matthew Prince
said the next day that they were seeing 400 per
second exploit attempts, which is absurd numbers.
Rob Wright: Yeah, I'm not great at math. That
seems like a lot.
Alexander Culafi: Yeah.
Rob Wright: So there are a lot of attacks. The
vulnerability is bad. What can organizations do to
protect themselves?
Alexander Culafi: The good news is shortly after
this was disclosed the Apache Software Foundation,
which is responsible for Log4J, they released a
patch for this, that takes care of the
configuration issues that allow the original the
original vulnerability to happen in the first
Rob Wright: And we talked about how things are
place.
changing. Minute by minute, there is an issue now
where another vulnerability was found. This is all
very complicated. And there's a new version 2.16
That is out from Apache this week for Log4J and it
addresses another vulnerability somebody
discovered that the original patch for Log4Shell
did not fully close the vulnerability and that
organizations were still open to a denial of
service attack. This new version 2.16 closes that
vulnerability and Apache Software also said that
based on the revelation of the new vulnerability,
that some of the old mitigations that they
recommended don't quite work as well. So there's
all new documentation out there and we encourage
all of the organizations out there that have Log4J
in their environments to go read that and download
the latest version 2.16 Because you want to be as
up to date as possible with Log4Shell