Q: What should I be doing about the Log4j vulnerability?
A: In what is considered one of the most widespread and dangerous vulnerabilities to be discovered in a very long time, the Log4j problem is going to be a threat that will likely linger for a long time.
The reason this discovery is considered a nightmare scenario is because of the ubiquity of the tool that is being compromised and the difficulty in determining where it is being used.
Free logging tool
At the heart of the problem is a very popular open-source tool (Log4j) used to log activity – it can be easily compromised on millions of devices that connect to the Internet.
The tool can be instructed to allow what is known as ‘Remote Code Execution’, which can allow a remote user to take control of the device.
The good news is that it will be a pretty easy thing to fix but the bad news is that it’s going to take a long time to determine where it’s being used.
Anyone along the manufacturing process of any device or the development of any software program could have used the logging tool, so it’s many needles in many haystacks.
The best analogy that I’ve heard is to think of it as a common nail used by millions of construction companies on millions of construction projects and the nail has been found to deteriorate to the point that it could fail.
This means every construction company has to figure out where they used this nail on every construction project they or any of their subcontractors has ever completed.
Active attempts to exploit Log4j
For cyber criminals, exploiting this tool’s vulnerability is like shooting fish in a barrel because it’s so widespread.
Security firm Cloudflare posted that it saw the first attempts to exploit the vulnerability just nine minutes after the problem was disclosed publicly.
To date, millions of hacking attempts have already been made and we can expect them to grow in popularity and sophistication.
Of particular concern is the ability to launch a ransomware attack without the need to trick a user into doing something that allows them in.
What you need to do
The majority of the work to fix the vulnerability has to be done by the manufacturers and developers of the exposed products, which then need to be distributed to all of their users.
If you’re a small business, you or your IT resources should be checking the support website for your software programs and hardware devices for posted updates or alerts.
In some cases, there may be some temporary mitigation steps that can be taken until a patch has been developed.
If you are using really old technology that no longer gets updates, you may need to consider replacing it altogether or make sure it’s no longer connected to the Internet.
Don’t Ignore Update Notices
Large businesses are a more attractive target at the moment, but as time goes on, we’re likely going to see attempts to exploit the average user.
Make sure to install security updates when they are made available on any and all of your computers, smartphones, tablets, software programs and ‘smart home’ devices to plug the holes that could allow you to be exploited.
Ken Colburn is founder and CEO of Data Doctors Computer Services. Ask any tech question on Facebook or Twitter.
