A massive cybersecurity vulnerability discovered in an Apache logging tool has caused chaos across the internet, as organisations rush to patch millions of web-based services around the world.

The Log4j weakness exploits a bug in Apache’s open-source Log4j v.2 logging Java library, allowing an outside user to insert their own code that Log4j will interpret as ‘real’ instructions, to devastating effect.

Log4j is highly common across huge numbers of web-based services, servers with web based front-ends, and countless devices that support some kind of web-based maintenance – such as routers, network switches and many more.

A horrifying compilation of screenshots gathered on GitHub shows how (at time of writing) hackers can already exploit the bug everywhere from the search fields of Linkedin, Amazon and Baidu, to the login pages of Apple and Cloudflare, across Webex meetings and even the chat boxes on online games such as Minecraft.

In each case hackers can use the vulnerability to have the device’s network-access ability either forward confidential information to another URL, or retrieve a payload from another website. According to reports by ARSTechnica, the trick has already been used in the wild, with researchers seeing new botnets, crypto-mining malware and more installed by hackers.

CVE-2021-44228 is graded ‘Critical’ by Apache, and SysAdmins are advised to patch services urgently.

July 14th: as Microsoft flag a ‘Critical’ Level-10 DNS vulnerability on Domain Name System (DNS) servers worldwide, Lineal engineers rush to patch the infrastructure of dozens of organisations overnight.

The Microsoft Security Response Center recently released details of CVE-2020-135, a ‘Critical Remote Code Execution’ weakness deemed ‘wormable’ (potentially spreading between devices automatically) affecting all Windows Server versions.

A grade of 10.0 is the highest possible severity level that can be assigned under the Common Vulnerability Scoring System Calculator. For comparison the WannaCry attack, which temporarily crippled the NHS in 2017, had a CVSS rating of 8.5.

Lineal staff use remote monitoring software to administer large numbers of client servers and devices, monitor hardware health and deploy patches more rapidly – and were quickly on the case overnight to patch the vulnerability as a special emergency.

Within 8 hours we’d patched a large number of DNS servers – applying both an initial fix and further scheduled updates.

DNS is a naming technology which translates the identities of computers, servers and other networked devices into the IP addresses used for connecting on private and public IT networks.

For this reason, DNS servers often have massive reach, and must be carefully protected to mitigate the risk of compromising an organisation’s technology on a huge scale – even across the globe.

Israeli IT security firm Checkpoint Software Technologies, who discovered the 17-year old hidden bug and reported it to Microsoft, argue ‘this is not just another vulnerability’ and risks handing an attacker ‘complete control of your IT’ if IT admins fail to address the issue urgently.

For IT expertise and support, please contact our team today.