DATA DOCTORS

The Log4j threat: What everyone should do

Dec 18, 2021, 5:00 AM
(Pexels Photo)...
(Pexels Photo)
(Pexels Photo)

Q: What should I be doing about the Log4j vulnerability?

A: In what is considered one of the most widespread and dangerous vulnerabilities to be discovered in a very long time, the Log4j problem is going to be a threat that will likely linger for a long time.

The reason this discovery is considered a nightmare scenario is because of the ubiquity of the tool that is being compromised and the difficulty in determining where it is being used.

Free Logging Tool

At the heart of the problem is a very popular open-source tool (Log4j) used to log activity – it can be easily compromised on millions of devices that connect to the Internet.

The tool can be instructed to allow what is known as ‘Remote Code Execution’, which can allow a remote user to take control of the device.

The good news is that it will be a pretty easy thing to fix but the bad news is that it’s going to take a long time to determine where it’s being used.

Anyone along the manufacturing process of any device or the development of any software program could have used the logging tool, so it’s many needles in many haystacks.

The best analogy that I’ve heard is to think of it as a common nail used by millions of construction companies on millions of construction projects and the nail has been found to deteriorate to the point that it could fail.

This means every construction company has to figure out where they used this nail on every construction project they or any of their subcontractors has ever completed.

Active Attempts To Exploit Log4j

For cyber criminals, exploiting this tool’s vulnerability is like shooting fish in a barrel because it’s so widespread.

Security firm Cloudflare posted (https://bit.ly/3pdV3Xr) that it saw the first attempts to exploit the vulnerability just nine minutes after the problem was disclosed publicly.

To date, millions of hacking attempts have already been made and we can expect them to grow in popularity and sophistication.

Of particular concern is the ability to launch a ransomware attack without the need to trick a user into doing something that allows them in.

What You Need To Do

The majority of the work to fix the vulnerability has to be done by the manufacturers and developers of the exposed products, which then need to be distributed to all of their users.

If you’re a small business, you or your IT resources should be checking the support website for your software programs and hardware devices for posted updates or alerts.

In some cases, there may be some temporary mitigation steps that can be taken until a patch has been developed.

If you are using really old technology that no longer gets updates, you may need to consider replacing it altogether or make sure it’s no longer connected to the Internet.

Don’t Ignore Update Notices

Large businesses are a more attractive target at the moment, but as time goes on, we’re likely going to see attempts to exploit the average user.

Make sure to install security updates when they are made available on any and all of your computers, smartphones, tablets, software programs and ‘smart home’ devices to plug the holes that could allow you to be exploited.

We want to hear from you.

Have a story idea or tip? Pass it along to the KTAR News team here.

Data Doctors

(Photo by Kirk McKoy/Los Angeles Times via Getty Images)...
Data Doctors

Tips and tricks for restarting unresponsive computers

Malicious programs won’t appear with an icon on your taskbar or provide you with any indication that they’re running.
5 days ago
(Pexels Photo)...
Data Doctors

Finding the easiest ways to sell travel photos online

The quality of photos that smartphones are capable of capturing is spectacular and anyone can try selling them online.
12 days ago
(Pexels Photo)...
Data Doctors

Here’s an explanation on LastPass password management security

After several breaches at LastPass password management, some users may be wondering if it's still safe to use.
19 days ago
(Pexels Photo)...
Data Doctors

Preventative maintenance tips to help computers run better

As with many other items in our lives, preventative maintenance is the key to avoiding expensive repairs that often come as a surprise.
1 month ago
(Pexels Photo)...
Data Doctors

Tips for accessing and listening to free audiobooks

Most of these apps will also allow you to load them on multiple devices, so you can start listening and pick up where you left off.
1 month ago
The TikTok logo is displayed outside a TikTok office on December 20, 2022 in Culver City, Californi...
Data Doctors

Here’s what parents should know about their children using TikTok

Understanding the risks of any app or social media platform that your children use has become an essential parental responsibility, but TikTok poses some unique considerations.
2 months ago

Sponsored Articles

...
Day & Night Air Conditioning, Heating and Plumbing

Company looking for oldest air conditioner and wants to reward homeowner with new one

Does your air conditioner make weird noises or a burning smell when it starts? If so, you may be due for an AC unit replacement.
(Desert Institute for Spine Care photo)...
DESERT INSTITUTE FOR SPINE CARE

Why DISC is world renowned for back and neck pain treatments

Fifty percent of Americans and 90% of people at least 50 years old have some level of degenerative disc disease.
...
Quantum Fiber

Stream 4K and more with powerful, high-speed fiber internet

Picking which streaming services to subscribe to are difficult choices, and there is no room for internet that cannot handle increased demands.
The Log4j threat: What everyone should do