The urgent need to keep Data Secure in Light of Apache Log4j Vulnerabilities

The recent cyberattack has the potential to wipe out the Internet, putting NASA, smart TVs, and Minecraft in standstill. With this, Amazon and Google are now vulnerable to a sophisticated hacking attack, making the 'worst-ever' Internet security flaw 'apocalyptic' for the computer industry. The flaw, which may allow hackers to take control of nearly everything on the Internet, has apparently made IT giants nervous. According to the Seattle Times, employees at Silicon Valley corporations have been working all-nighters to guarantee their code is secure.

The Log4Shell, Apache Software Foundation released information on two critical vulnerabilities in its Log4j Java-based library. The vulnerability is based on an open-source logging library used in most applications by enterprises and even government agencies. The exploits for this vulnerability are already being tested by hackers. The problem impacts Log4j 2 versions which is a very common logging library used by applications across the world. Logging lets developers see all the activity of an application.

The first vulnerability CVE-2021-44228, also known as Log4Shell or LogJam, was reported as an unauthenticated remote code execution vulnerability. By exploiting how the library logs error messages, it could lead to a complete system takeover. Log4j is one of the most widely-used logging libraries in the world. Its adaptable logging capabilities make it useful across any type of infrastructure or application. Countless enterprise, government and open-source applications use Log4j.

Tech companies such as Apple, Microsoft, Google all rely on this open-source library, as do enterprise applications from CISCO, Netapp, CloudFare, Amazon and others. The potential scope of the initial RCE vulnerability CVE-2021-44228 is astounding. Any device or app connected to the internet running Log4j versions 2.0-2.14.1, is at risk.

In addition, exploiting the vulnerability is relatively straightforward. By simply sending a malicious string that then gets logged by the application, attackers can exploit a feature in log4j that can be used to retrieve information. Here the attackers use the Java naming and Directory Interface to make an external network request for the malicious payload in the form of a Java file. From there, the attacker would be free to deliver whatever malware or backdoor entry to the infrastructure.‍

Secondly, the vulnerability CVE-2021-45046 was uncovered shortly after the initial patch was released. According to the CVE description, the initial patch was “incomplete” and this new exploit “could allow attackers… to craft malicious input data using a JNDI lookup pattern resulting in a denial of service attack.”‍ It is also able to update any server, app or resource that uses Log4j with the latest patch immediately. This patch includes coverage for both the latest DOS vulnerability and the original RCE vulnerability.‍

As soon as the proof of concept exploit was released on Github, threat actors began actively scanning the internet for vulnerable assets. Lookout customers who use the Lookout Security Platform, our Secure Access Service Edge solution, are equipped with several ways to protect their sensitive data and mitigate risks associated with this vulnerability.‍

Deepak Sahu, President & CEO, VARINDIA