Current:Home > ScamsSecurity experts race to fix critical software flaw threatening industries worldwide-Angel Dreamer Wealth Society D1 Reviews & Insights
Security experts race to fix critical software flaw threatening industries worldwide
View Date:2024-12-23 18:47:11
BOSTON — A critical vulnerability in a widely used software tool — one quickly exploited in the online game Minecraft — is rapidly emerging as a major threat to organizations around the world.
"The internet's on fire right now," said Adam Meyers, senior vice president of intelligence at the cybersecurity firm Crowdstrike. "People are scrambling to patch," he said, "and all kinds of people scrambling to exploit it." He said Friday morning that in the 12 hours since the bug's existence was disclosed that it had been "fully weaponized," meaning malefactors had developed and distributed tools to exploit it.
The flaw may be the worst computer vulnerability discovered in years. It was uncovered in an open-source logging tool that is ubiquitous in cloud servers and enterprise software used across industry and government. Unless it is fixed, it grants criminals, spies and programming novices alike easy access to internal networks where they can loot valuable data, plant malware, erase crucial information and much more.
"I'd be hard-pressed to think of a company that's not at risk," said Joe Sullivan, chief security officer for Cloudflare, whose online infrastructure protects websites from malicious actors. Untold millions of servers have it installed, and experts said the fallout would not be known for several days.
Amit Yoran, CEO of the cybersecurity firm Tenable, called it "the single biggest, most critical vulnerability of the last decade" — and possibly the biggest in the history of modern computing.
The vulnerability, dubbed "Log4Shell," was rated 10 on a scale of one to 10 the Apache Software Foundation, which oversees development of the software. Anyone with the exploit can obtain full access to an unpatched computer that uses the software,
Experts said the extreme ease with which the vulnerability lets an attacker access a web server — no password required — is what makes it so dangerous.
New Zealand's computer emergency response team was among the first to report that the flaw was being "actively exploited in the wild" just hours after it was publicly reported Thursday and a patch released.
The vulnerability, located in open-source Apache software used to run websites and other web services, was reported to the foundation on Nov. 24 by the Chinese tech giant Alibaba, it said. It took two weeks to develop and release a fix.
But patching systems around the world could be a complicated task. While most organizations and cloud providers such as Amazon should be able to update their web servers easily, the same Apache software is also often embedded in third-party programs, which often can only be updated by their owners.
Yoran, of Tenable, said organizations need to presume they've been compromised and act quickly.
The first obvious signs of the flaw's exploitation appeared in Minecraft, an online game hugely popular with kids and owned by Microsoft. Meyers and security expert Marcus Hutchins said Minecraft users were already using it to execute programs on the computers of other users by pasting a short message in a chat box.
Microsoft said it had issued a software update for Minecraft users. "Customers who apply the fix are protected," it said.
Researchers reported finding evidence the vulnerability could be exploited in servers run by companies such as Apple, Amazon, Twitter and Cloudflare.
Cloudflare's Sullivan said there we no indication his company's servers had been compromised. Apple, Amazon and Twitter did not immediately respond to requests for comment.
veryGood! (261)
Related
- What Just Happened to the Idea of Progress?
- House Republicans jump to Donald Trump's defense after he says he's target of Jan. 6 probe
- DOJ sues to block JetBlue-Spirit merger, saying it will curb competition
- Fox News stands in legal peril. It says defamation loss would harm all media
- Princess Kate to host annual Christmas carol service following cancer treatment
- Kim Kardashian Shares Twinning Photo With Kourtney Kardashian From North West's Birthday Party
- Dave Grohl's Daughter Violet Joins Dad Onstage at Foo Fighters' Show at Glastonbury Festival
- Baltimore Continues Incinerating Trash, Despite Opposition from its New Mayor and City Council
- Jake Paul's only loss led him to retool the team preparing him to face Mike Tyson
- Businessman Who Almost Went on OceanGate Titanic Dive Reveals Alleged Texts With CEO on Safety Concerns
Ranking
- Brittany Cartwright Defends Hooking Up With Jax Taylor's Friend Amid Their Divorce
- Dave Grohl's Daughter Violet Joins Dad Onstage at Foo Fighters' Show at Glastonbury Festival
- Pregnant Kourtney Kardashian Reveals the Sex of Her and Travis Barker's Baby
- A U.S. federal agency is suing Exxon after 5 nooses were found at a Louisiana complex
- 32 things we learned in NFL Week 10: Who will challenge for NFC throne?
- Can TikTokkers sway Biden on oil drilling? The #StopWillow campaign, explained
- Racial bias in home appraising prompts changes in the industry
- You're Going to Want All of These Secrets About The Notebook Forever, Everyday
Recommendation
-
What to know about Mississippi Valley State football player Ryan Quinney, who died Friday
-
Biden and the EU's von der Leyen meet to ease tensions over trade, subsidy concerns
-
Bison gores woman at Yellowstone National Park
-
Warming Trends: A Potential Decline in Farmed Fish, Less Ice on Minnesota Lakes and a ‘Black Box’ for the Planet
-
Democrat Cleo Fields wins re-drawn Louisiana congressional district, flipping red seat blue
-
California toddler kills 1-year-old sister with handgun found in home, police say
-
How to prevent heat stroke and spot symptoms as U.S. bakes in extreme heat
-
Farming Without a Net