Singapore firms warned to quickly fix Log4j software security hole that world experts call worst in years
[SINGAPORE] Organisations should take swift action to patch a "critical vulnerability" in a widely used software that could allow hackers to take full control of computer systems, the Cyber Security Agency of Singapore (CSA) said on Tuesday (Dec 14).
This is because "we only have a short window" to put in place measures to limit any abuse of the flaw, warned the agency.
The flaw, which affects a wide range of applications from social media and gaming to online shopping and banking, is likely to affect hundreds of millions of devices, the United States' national cyber-security agency said on Monday, adding that it could be one of the worst in years.
The affected Apache Log4j is a free, open source software that is popularly used to log and keep track of activities and changes in software applications, including system errors and messages from users.
Public and private sector organisations are expected to be affected.
Cyber-security experts warned that the flaw can be easily exploited by adding just a line of code. This could allow cyber crooks to, among other things, abuse the vulnerability to steal and delete data, hijack a company's e-mail system to send phishing messages to other firms, and make fraudulent bank transfers.
BT in your inbox
Start and end each day with the latest news stories and analyses delivered straight to your inbox.
Among the services and sites known to be vulnerable at some point include Apple's iCloud online back-up service, Valve's Steam online game store and Microsoft's Minecraft online game. Other firms reportedly at risk include Amazon, Baidu, Google, Tencent and Twitter.
While CSA has not received any reports of breaches related to the vulnerability for now, it is closely monitoring the situation.
CSA's urgent call to action follows from an initial alert it sent out last Friday.
It also comes after US Cybersecurity and Infrastructure Security Agency (Cisa) director Jen Easterly said the flaw, also called Log4Shell or LogJam, "is one of the most serious I've seen in my entire career, if not the most serious", reported cyber-security news site CyberScoop.
Last Saturday, Germany's cyber-security watchdog the BSI issued the highest red alert warning on the security hole, saying it posed an "extremely critical threat" to Web servers.
Apple and several companies have reportedly taken steps to patch the security hole, as was the case for iCloud, or alert customers on steps they can take to minimise the damage from the bug.
In the case of iCloud, files stored in it are encrypted and hackers are unlikely to be able to make sense of the content even if they break into the system.
But Kevin Reed, chief information security officer of cyber-security firm Acronis, said that one way the flaw, if unpatched, could still be abused is to delete people's photos stored in iCloud.
Cyber criminals appear to be rushing to find potential victims they can attack using the flaw."We aware of botnets using this vulnerability to compromise computers at scale," said Reed, referring to "zombie" devices linked to the Internet and infected with malware that allows hackers to control them and launch cyber attacks."Right now, the Internet is on fire. It's crazy - there are thousands and thousands of exploitation attacks happening every second," he added.
Reed said that the number of attempts by hackers to exploit the flaw was rising exponentially. Globally and in Singapore, his firm detected exploitation attempts in the single digits last Friday. But over the weekend, this spiked by 300 times."Normally, exploits do not grow as fast as that - this is on the scale of WannaCry," he said.
The WannaCry ransomware in 2017 struck many global systems and crippled hospitals in England and Scotland, government agencies in China and Russia, railway operations in Germany and car production facilities in France.
For now, because there are so many attack attempts, it is difficult to figure out if there are specific sectors being targeted, Reed said.
But the worst is yet to come and time is running out, with companies reportedly scrambling to patch the flaw."Because (Log4j) is everywhere and easy to exploit, we will see a lot of exploitation in the coming days, weeks, and maybe months," said Reed.
Copyright SPH Media. All rights reserved.
