Log4j software flaw ‘endemic,’ new cyber safety panel says

Jul 14, 2022, 8:25 AM | Updated: 8:59 am

A computer vulnerability discovered last year in a ubiquitous piece of software is an “endemic” problem that will pose security risks for potentially a decade or more, according to a new cybersecurity panel created by President Joe Biden.

The Cyber Safety Review Board said in a report Thursday that while there hasn’t been sign of any major cyberattack due to the Log4j flaw, it will still “be exploited for years to come.”

“Log4j is one of the most serious software vulnerabilities in history,” the board’s chairman, Department of Homeland Security Under Secretary Rob Silvers, told reporters Wednesday.

The Log4j flaw, made public late last year, lets internet-based attackers easily seize control of everything from industrial control systems to web servers and consumer electronics. The first obvious signs of the flaw’s exploitation appeared in Minecraft, a hugely popular online game owned by Microsoft.

The flaw’s discovery prompted urgent warnings by government officials and massive efforts by cybersecurity professionals to patch vulnerable systems.

The board said Thursday that “somewhat surprisingly” the exploitation of the Log4j bug had occurred at lower levels than experts predicted. The board also said that it was unaware of any “significant” Log4j attacks on critical infrastructure systems but noted that some cyberattacks go unreported.

The board said future attacks are likely in large part because Log4j is routinely embedded with other software and can be hard for organizations to find running in their systems.

“This event is not over,” Silvers said.

Log4j, written in the Java programming language, logs user activity on computers. Developed and maintained by a handful of volunteers under the auspices of the open-source Apache Software Foundation, it is extremely popular with commercial software developers.

A security researcher at the Chinese tech giant Alibaba notified the foundation on Nov. 24. It took two weeks to develop and release a fix. Chinese media reported that the government punished Alibaba for not reporting the flaw earlier to state officials.

The board said Thursday it found “troubling elements” with the Chinese government’s policy toward vulnerability disclosures, saying it could give Chinese state hackers an early look at computer flaws they could use for nefarious means like stealing trade secrets or spying on dissidents. The Chinese government has long denied wrongdoing in cyberspace and told the board that it encourages improved information sharing on software vulnerabilities.

The board offered a number of recommendations on mitigating the fallout of the Log4j flaw as well as improving cybersecurity generally. That includes the suggestion that universities and community colleges make cybersecurity training a required part of computer science degree and certification programs.

The Cyber Safety Review Board is modeled after the National Transportation Safety Board, which reviews plane crashes and other major accidents, and was mandated by an executive order Biden signed last May. The 15-member board is made up of FBI, National Security Agency and other government officials as well as people from the private sector. Some supporters of the new board criticized DHS for taking so long to get it up and running.

Biden’s executive order directed the board to conduct its first review on the massive Russian cyber espionage campaign known as SolarWinds. Russian hackers were able to breach several federal agencies, including accounts belonging to top cybersecurity officials at DHS, though the full fallout from that campaign is still unclear.

Silvers said DHS and the White House agreed that reviewing the Log4j flaw was a better use of the new board’s expertise and time.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

FILE - Maricopa County Recorder Stephen Richer speaks inside the Recorders Office, Nov. 9, 2022, in...
Associated Press

Dominion conspiracies highlighted by Fox lawsuit have election officials concerned for safety

Maricopa County officials are bracing for what could happen when it comes time to replace its contract for voting equipment.
2 days ago
A building is damaged and trees are down after severe storm swept through Little Rock, Ark., Friday...
Associated Press

Tornado causes widespread damage to buildings, vehicles in Little Rock

A tornado raced through Little Rock and surrounding areas Friday, splintering homes, overturning vehicles and tossing trees.
2 days ago
FILE - Former President Donald Trump speaks with reporters while in flight on his plane after a cam...
Associated Press

Worries grow that Trump indictment could undermine public confidence in other investigations

Trump’s attempts to overturn those results amid false claims of widespread fraud are at the heart of two other ongoing investigations.
2 days ago
(Facebook Photo/Superior Court of Arizona in Yavapai County)...
Associated Press

Arizona judge has cases reassigned following DUI arrest

The Arizona Supreme Court has ruled that all cases currently assigned to a Yavapai County Superior Court judge recently arrested on suspicion of extreme DUI will be reassigned to other judges.
6 days ago
Haitian migrant Gerson Solay, 28, carries his daughter, Bianca, as he and his family cross into Can...
Associated Press

US, Canada to end loophole that allows asylum-seekers to move between countries

President Joe Biden and Canadian Prime Minister Justin Trudeau on Friday announced a plan to close a loophole to an immigration agreement.
9 days ago
Expert skateboarder Di'Orr Greenwood, an artist born and raised in the Navajo Nation in Arizona and...
Associated Press

Indigenous skateboard art featured on new stamps unveiled at Phoenix skate park

The Postal Service unveiled the “Art of the Skateboard" stamps at a Phoenix skate park, featuring designs from Indigenous artists.
9 days ago

Sponsored Articles

...
Fiesta Bowl Foundation

Celebrate 50 years of Vrbo Fiesta Bowl Parade magic!

Since its first production in the early 1970s, the Vrbo Fiesta Bowl Parade presented by Lerner & Rowe has been a staple of Valley traditions, bringing family fun and excitement to downtown Phoenix.
...
Quantum Fiber

How high-speed fiber internet edges out cable for everyday use

In a world where technology drives so much of our daily lives, a lack of high-speed internet can be a major issue.
(Photo via MLB's Arizona Fall League / Twitter)...
Arizona Fall League

Top prospects to watch at this year’s Arizona Fall League

One of the most exciting elements of the MLB offseason is the Arizona Fall League, which began its 30th season Monday.
Log4j software flaw ‘endemic,’ new cyber safety panel says