Saturday, Jun 10, 2023

'Potential for damage incalculable': Experts sound alarm over cyber vulnerability in widely used software

'Potential for damage incalculable': Experts sound alarm over cyber vulnerability in widely used software

While the first victims hit by hackers were Minecraft players, experts warn the cyber vulnerability could soon be exploited by spies and organised criminals.

Security experts are sounding the alarm over a newly discovered software vulnerability, and organisations have been advised to "urgently" check whether it leaves them exposed to hackers.

Alerts have been issued by the British and American governments as a growing number of hacking groups - potentially including spies and organised criminals - are exploiting the vulnerability to break into computer networks.

The British government said it was treating "this issue with the utmost seriousness" as the US warned the vulnerability was "being widely exploited by a growing set of threat actors".

Researchers in the private sector said "the potential for damage is incalculable" with one describing the severity as: "The internet is on fire right now."

The UK government said it was treating the issue 'with the utmost seriousness'

What is the issue?

It is very rare for enterprise software to be completely written from the ground up for every different product.

Instead this software often depends on a shared library of open-source code maintained by charity organisations and distributed without any royalties.

The new vulnerability has been discovered in one such bit of code.

Known as Log4j, the open-source tool is an Apache Software Foundation project and used almost ubiquitously in enterprise software products and cloud services.

It won't directly impact people using personal devices, but any data they have with organisations that operate web servers could be at risk.

A fix has already been published by Apache - which described the vulnerability as "critical" - and large companies who control and update their own software should be able to quickly patch the vulnerability.

But because Log4j is so widely used as a logging utility there are likely to be thousands of companies exposed because the flaw affects third-party software which they cannot directly update.

Apache credited Chen Zhaojun, a security researcher at Chinese company Alibaba, for discovering and reporting the issue.

Minecraft players were among the first victims.

Who has been affected?

The first wave of victims were people playing the Microsoft-owned computer game Minecraft.

Hackers were able to post a short message in the Minecraft chatbox to remotely execute commands on the computers of other players.

Microsoft said it has patched the issue for Minecraft players and told customers they would be protected if they applied the fix.

The most obvious first wave of attacks all involved "cryptojacking", when hackers hijack victim's computers to use their processing power to mine cryptocurrencies.

Microsoft warned that alongside installing coin miners it had seen hackers exploiting the flaw to steal credentials and data from victim's computers.

"The internet's on fire right now. People are scrambling to patch and all kinds of people are scrambling to exploit it," said Adam Meyers, senior vice president of intelligence at cyber security company Crowdstrike.

The software flaw could be used to attack banks and even governments

'A very serious threat'

"I cannot overstate the seriousness of this threat," warned Lotem Finkelstein, director of threat intelligence for Check Point Software Technologies.

Mr Finkelstein warned that the cryptojacking activity "creates just the sort of background noise that serious threat actors will try to exploit in order to attack a whole range of high value targets".

Check Point has detected hundreds of thousands of attempts to exploit this vulnerability across more than a third of all corporate global networks.

"Security teams need to jump on this with utmost urgency as the potential for damage is incalculable," Mr Finkelstein added.

AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.

Related Articles

US and European Intelligence Agencies Uncover Evidence of Ukrainian Role in Terror Attack on Nord Stream Pipeline
Nvidia Joins Tech Giants as First Chipmaker to Reach $1 Trillion Valuation
Drone Attack on Moscow's Wealthiest Neighborhoods Suspected to be Launched by Ukraine
UK Prime Minister Rishi Sunak to Hold Power Talks with President Biden in Washington
AI ‘extinction’ should be same priority as nuclear war – experts
Prominent Hacker Forum RaidForums Suffers Substantial Data Breach
Nvidia CEO Huang says firms, individuals without AI expertise will be left behind
WPP Revolutionizes Advertising with NVIDIA's AI Powerhouse
Two US Employees Fired For Chasing Robbers Out Of Store As They Broke ''Company Policy''
If you donated to BLM, you got played
Pfizer, the EU, and disappearing ink - Smoke, Mirrors, and the Billion-Dose Pfizer Vaccine Deal: EU's 'Open Secret
Actor Tom Hanks told Harvard University graduates to be superheroes in their defense of truth and American ideals, and to resist those who twist the truth for their own gain
The Sussexes' Royal Rebound: Could Harry and Meghan Markle Return to the UK?
A provocative study suggests: Left-Wing Extremism and its Unsettling Connection to Psychopathy and Narcissism
France Arrests 10 on Suspicion of Failing to Respond in Time to Migrant Drowning
Neuralink Receives FDA Approval for First-in-Human Clinical Study
Saudi Arabia and Canada Restore Diplomatic Relations
Bernard Arnault Loses $11.2 Billion in One Day as Investors Fear Slowdown in US Growth Will Reduce Demand for Luxury Products
Russian’s Wagner Group leader: “I am not a chef, I am a butcher. Russia is in danger of a revolution like in 1917.”
TikTok Sues Montana Over Law Banning the App
Ron DeSantis Jumps Into 2024 Presidential Race, Setting Up Showdown With Trump
Last Walmart in North Portland Closing Down
Florida's DeSantis seeks to disqualify judge in Disney case
Talks between US House Republicans and President Biden's Democratic administration on raising the federal government's $31.4tn debt ceiling have paused
Disney has canceled plans to build a new campus in Florida worth almost $1 billion
Biden Administration Eyeing High-Profile Visits to China: The Biden Administration is heating things up by looking into setting up a series of top-level visits to Beijing by top officials in the coming months
New evidence in special counsel probe may undercut Trump’s claim documents he took were automatically declassified
A French court of appeals confirmed former President Nicolas Sarkozy's three-year jail term for corruption and influence peddling
Debt Ceiling Crises Have Unleashed Political Chaos
Weibao Wang, a former software engineer at Apple, was charged with stealing trade secrets related to autonomous systems, including self-driving cars
Mobile phone giant Vodafone to cut 11,000 jobs globally over three years as new boss says its performance not good enough
Elon Musk compares George Soros to Magneto, the supervillain from the Marvel Comics series.
Warren Buffett Sells TSMC Shares Over Concerns About Taiwan's Stability
New Study Finds That Secondary Bacterial Pneumonia Is a Major Cause of Death in COVID-19 Patients Who Require Ventilator Assistance
King Charles III being crowned.
'Godfather Of AI' Geoffrey Hinton Quits Google To Warn Of The Tech's Dangers
A Real woman
Vermont Man Charged with Stalking After Secretly Tracking Woman with Apple AirTag
Elon Musk Statements About Tesla Autopilot Could Be 'Deepfakes,' Lawyers Claim. Judge Evette Pennypacker Does Not Understand How Far and Advanced This Technology Became
Ukraine More Prepared for Counterattack as Reinforcements Arrive
UK Prime Minister Rishi Sunak and Italian Prime Minister Giorgia Meloni Discuss Migration, Defence, and Ukraine
Tucker Carlson is back, soon!
AT&T's Successful Test of Satellite-Based Phone Call Raises Possibility of Widespread Coverage
CNN: "Joe Biden is asking for four more years — when 74% of Americans think the country is heading the wrong way“
Turkish President Recep Tayyip Erdogan Cuts Short Live TV Interview Due to Health Issue
US Congresswoman threaten Twitter Files journalist with arrest
Pulitzer Prize-winning journalist Seymour Hersh slams New York Times' pro-government stance and treatment of sources
Enough is enough: it's time to end the war in Ukraine. While Russia may be to blame for starting it, Russia is not the one refusing to stop it
Fox News Settles their case with Dominion Voting Systems for a staggering $787.5 MILLION
The land of the free violence