durability is a word that hackers, love and Internet
users will fear. There's a new software flaw. The White
House is calling a severe threat, and you may not have
heard about it. Web stories like the surfaced over the
last week headlines like Log four J Vulnerability
Cleanup expected to take months or years from the media,
and the race is on to patch Log for Shell. The bug
that's breaking the Internet from TechCrunch, the
director of the agency tasked to take on these issues
shared this warning to CNBC. The Log four J
vulnerability is the most serious vulnerability that
I've seen in my decades long career. Everyone s
assume that they are exposed and vulnerable and to
check and make sure that they're not vulnerable. Te
correspondent Tyler Atkinson knows this industry and
its unknowns far better than most. So Tyler, for those
of ours who are not the most tech savvy, put this in
terms. We can all understand wh is log for J. And why
is this digital flaw getting the attention right now So
effectively Log four J is a logging library. It's a
free and open source tool that is used by programmers
and developers to effectively b able to look at the
amount of traffic and other things that are going on in
a given application or server that they're running. So
you know, say you write down your daily activities in a
notebook or somewhere else. Log four J essentially does
the same thing, but it allows these developers and
programmers to also go look at those logs in order to
troubleshoot security incidents or other things like
that effectively. This new vulnerability allows hacker
to use that tool to perform what's known as a remot
code execution, which means that they can send
malicious code through this tool to a machine and
effectively access all the data on any effective
machine. At this point, there's some nation states that
are involved in this or thought to be involved in this
as well. But right now, really, what we're seeing is
that we're just that cyber criminals of all sorts are
just using this in order to try to be able to get into
places. According to the Cyber Security group check
Point research. Within 72 hours of the initial outbreak,
they detected at least 800,000 attacks of this sort.
And since last Friday, that same team has detected 1.8
million log four j exploit attempts on almost half of
all corporate networks that they track at this point.
So really, the thing is that because this tool is so
widely used and because it's free and a lot of people
rely on it were really even trying to get a sense of
just how big the problem is right now. Okay, So given
how widespread the problem could be, how quickly, then
can we fix the issue It's going to be It's not
something that comes in the next days or weeks. It
might be a thing that goes on for months here. You know,
when we hear about ransomware attacks, usually the
hitting a single business, and the issue is sort of
contained to that one entity. But this is more of a
supply chain attack, where a piece of software that's
used by businesses all over the place are effectively
being exploited by this. I spoke to former White House
CEO Theresa Theresa Payton, and she basically told me
that cybercriminals are going to be able to utilize
this exploit to run future attacks, even if they don't
want to do anything right now, Take a listen. Once the
Attackers gain a toehold leveraging this vulnera
they may sit in stealth mode and not do anything. An
organization may go ahead and patch and not know
they're there to eradicate them And so they could, you
know, basically engage and exec uh, some type of a
cyber attack in the months and weeks, perhaps years to
come. That's really difficult about all of this. Is
that you know, you may not be able to like the current
position you're in. Go in and see whether or not your
business has been utilizing blog for J. You know,
usually it takes some kind of forensic or cyber
forensic researcher to go in and look to see how your
traffic runs through. And if it runs through these log
four j loggers, Okay, So how long could this threat
linger with us Into the future Yes. So, I mean, this
could be something depending on how cybercriminals use
it where we see some initial attacks already st
to come in place in the next few days, or we can really
see this going out for the next few months because
there are patches out there to fix this issue right now.
But really, what comes into play here is you have to
know that your systems are even vulnerable right now
and you have to go and make sure that you put those
patches in place. Now there is a bit of a deadline, at
least in some senses where cisa once certain federal
agencies to make sure that they have a patch in place
by Christmas Eve because really one of the things
that's also kind of interesting about this is the
timing of all. In the past, when we've seen these maj
supply chain attacks come out, they usually happen
around holiday seasons because these cybercriminals ar
privy to knowing that there's not going to be people
around, You know, The cassia attack was discovered on
July 2nd, which was the Friday before Independence
When you know that people are going to be gone for a
long time. It's a great time to launch these attacks.
Okay, Tyler Atkinson. Thank you so much for breaking
down all the text. Speak for us. Thank you.