PanamaTimes

Wednesday, Oct 09, 2024

'Potential for damage incalculable': Experts sound alarm over cyber vulnerability in widely used software

'Potential for damage incalculable': Experts sound alarm over cyber vulnerability in widely used software

While the first victims hit by hackers were Minecraft players, experts warn the cyber vulnerability could soon be exploited by spies and organised criminals.

Security experts are sounding the alarm over a newly discovered software vulnerability, and organisations have been advised to "urgently" check whether it leaves them exposed to hackers.

Alerts have been issued by the British and American governments as a growing number of hacking groups - potentially including spies and organised criminals - are exploiting the vulnerability to break into computer networks.

The British government said it was treating "this issue with the utmost seriousness" as the US warned the vulnerability was "being widely exploited by a growing set of threat actors".

Researchers in the private sector said "the potential for damage is incalculable" with one describing the severity as: "The internet is on fire right now."

The UK government said it was treating the issue 'with the utmost seriousness'


What is the issue?


It is very rare for enterprise software to be completely written from the ground up for every different product.

Instead this software often depends on a shared library of open-source code maintained by charity organisations and distributed without any royalties.

The new vulnerability has been discovered in one such bit of code.

Known as Log4j, the open-source tool is an Apache Software Foundation project and used almost ubiquitously in enterprise software products and cloud services.

It won't directly impact people using personal devices, but any data they have with organisations that operate web servers could be at risk.

A fix has already been published by Apache - which described the vulnerability as "critical" - and large companies who control and update their own software should be able to quickly patch the vulnerability.

But because Log4j is so widely used as a logging utility there are likely to be thousands of companies exposed because the flaw affects third-party software which they cannot directly update.

Apache credited Chen Zhaojun, a security researcher at Chinese company Alibaba, for discovering and reporting the issue.

Minecraft players were among the first victims.


Who has been affected?


The first wave of victims were people playing the Microsoft-owned computer game Minecraft.

Hackers were able to post a short message in the Minecraft chatbox to remotely execute commands on the computers of other players.

Microsoft said it has patched the issue for Minecraft players and told customers they would be protected if they applied the fix.

The most obvious first wave of attacks all involved "cryptojacking", when hackers hijack victim's computers to use their processing power to mine cryptocurrencies.

Microsoft warned that alongside installing coin miners it had seen hackers exploiting the flaw to steal credentials and data from victim's computers.

"The internet's on fire right now. People are scrambling to patch and all kinds of people are scrambling to exploit it," said Adam Meyers, senior vice president of intelligence at cyber security company Crowdstrike.

The software flaw could be used to attack banks and even governments


'A very serious threat'


"I cannot overstate the seriousness of this threat," warned Lotem Finkelstein, director of threat intelligence for Check Point Software Technologies.

Mr Finkelstein warned that the cryptojacking activity "creates just the sort of background noise that serious threat actors will try to exploit in order to attack a whole range of high value targets".

Check Point has detected hundreds of thousands of attempts to exploit this vulnerability across more than a third of all corporate global networks.

"Security teams need to jump on this with utmost urgency as the potential for damage is incalculable," Mr Finkelstein added.

Newsletter

Related Articles

PanamaTimes
0:00
0:00
Close
The Impact of Online Culture on Young Women: Survey Insights
Hypersonic Jet to Revolutionize Air Travel
Facilitated Communication: Miracle Tool or Manipulative Method?
US Election 2024: A Deadlock Between Trump and Harris
Dominica Sells Citizenship to Boost Climate Resilience
Elon Musk's X Faces Fines and Account Error in Brazil
Scott Jennings leaves CNN panel speechless as he tears apart Tim Walz's flimsy excuse of being "too dumb to tell the truth."
Earth Faces Severe Geomagnetic Storm from Solar Flare
China-Led Bloc Challenges The Quad in Indo-Pacific Region
Biden-Harris sent forklifts to open the border when Texas built a razor wall.
Storm Helene Devastates Eastern and Midwestern US, Claims 44 Lives
Trump Taps Elon Musk to Lead Federal Spending Cuts, Promising Trillions in Savings
Importing voters: With an election looming, the U.S. is approving citizenship applications at the fastest speed in years.
Hurricane Helene Set to Slam Florida with 'Unsurvivable' Conditions
El Salvadoran President Bukele at the UN: "Some complain that we put thousands in prison. In reality, we set millions free."
Google Commits 120 Million Dollars for Global AI Education: Sundar Pichai
Tennessee Woman Sentenced for Attempted Murder-For-Hire
Amazon Rainforest Suffers Massive Deforestation
Earth's Planetary Boundaries Breached
Elon Musk’s X Circumvents Brazil’s Supreme Court Block
Brazilian Judge Accuses Elon Musk’s X of Circumventing Court-Ordered Ban
Venezuelan Opposition Leader Coerced into Recognizing Maduro's Victory
Brazil's Firefighters Battle Amazon Blazes and Arsonists
X Social Media Platform Ordered Offline Again in Brazil
Global Workdays Required to Afford iPhone 16
In his podcast, Joe Rogan rightly questioned, "YOU NEED A VACCINE PASSPORT FOR FOOD, BUT VOTER ID IS ‘RACIST'?!"
Trump Unveils New Cryptocurrency Venture Amidst Campaign
X Update Enables App to Bypass Brazil Ban, Say Internet Providers
Delta Airlines Sets Strict Wardrobe Guidelines for Flight Attendants
Norway Achieves Milestone in Electric Vehicle Adoption
Hezbollah Hit by Explosive Pagers in Lebanon
Ex-Soldier Describes Trump Assassination Suspect's Troubled Ukraine Stint
Ghislaine Maxwell's Sex-Trafficking Conviction Upheld by Appeals Court
El Salvador's Bold Move: President Bukele Declares End to External Debt Reliance, Thanks to Bitcoin
Murdoch Family Succession Battle Begins
TikTok Faces Potential Ban in the US Amid Free Speech Concerns
Secret Service Investigates Elon Musk's Controversial Social Media Post
Meta Bans Russian State Media Networks
Impact and Aftermath of 9/11 Attacks on the US and the World
Internet Surpasses TV as UK's Leading News Source
Significant Corruption Concerns in Covid Contracts
MORAES WILL NOT SILENCE ME: "I WAS BORN FREE, I WILL DIE FREE!"
BRAZIL’S SUPREME COURT MINISTER ORDERS EXPLANATION ON X BLOCKING
Porn streamer OnlyFans paid owner $630mn in dividends
Donald Trump will not face sentencing over his 'hush money' conviction before the US presidential election on November 5, after a Manhattan judge granted his request to delay the proceeding
Return of Brazilian Artworks to Bahia
France Pilots Mobile Phone Ban in Schools
WHO-Led Study Finds No Link Between Mobile Phones and Brain Cancer
Kamala Harris is in Detroit and has a new accent again
EU Rejects Maduro’s Election Win Claim in Venezuela
×