CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.7%
The Federal Trade Commission (FTC) will muster its legal muscle to pursue companies and vendors that fail to protect consumer data from the risks of the Log4j vulnerabilities, it warned on Tuesday.
“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future,” according to the warning.
Those companies that bungle consumer data, leaving vulnerabilities unpatched and thus opening the door to exploits and the resulting possible “loss or breach of personal information, financial loss and other irreversible harms,” are risking consequences tied to weighty laws that have resulted in fat fines, the FTC said.
It mentioned, among others, the Federal Trade Commission Act and the Gramm-Leach-Bliley Act. The FTC Act, the commission’s primary statute, enables it to seek monetary redress and other relief for conduct injurious to consumers. Gramm-Leach-Bliley requires financial institutions to safeguard sensitive data.
“ It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action,” the FTC urged.
The FTC means it: Its warning included a reference to the complaints against Equifax, which agreed to pay $700 million to settle actions by the FTC, the Consumer Financial Protection Bureau, and all fifty states over its infamous 2017 data leak (consumers’ reaction at the time: Make it hurt more).
According to the Equifax complaint, its failure to patch a known vulnerability “irreversibly exposed the personal information of 147 million consumers.” Expect more of the same if your company fails to protect consumer data from exposure as a result of Log4Shell or whatever similar, known vulnerabilities crop up, it said.
The FTC advised companies to use guidance from the Cybersecurity and Infrastructure Security Agency (CISA) to check if they’re using Apache’s Log4j logging library, which is at the heart of the cluster of vulnerabilities known as Log4Shell.
Companies that find that they are using Log4j should do the following, CISA recommended:
On Dec. 17, CISA issued an emergency directive mandating federal civilian departments and agencies to immediately patch their internet-facing systems for the Log4j vulnerabilities by Thursday, Dec. 23. Federal agencies were given five more days – until Dec. 28 – to report Log4Shell-affected products, including vendor and app names and versions, along with what actions have been taken – e.g. updated, mitigated, removed from agency network – to block exploitation attempts.
CISA provides a dedicated page for the Log4Shell flaws with patching information and has released a Log4j scanner to hunt down potentially vulnerable web services.
The initial flaw – CVE-2021-44228 – was discovered on Dec. 9 and came under attack within hours. As of Dec. 15, more than 1.8 million attacks, against half of all corporate networks, using at least 70 distinct malware families, had already been launched to exploit what became a trio of bugs:
At this point, the Conti ransomware gang has had a full attack chain in place for weeks.
In a Monday update, Microsoft said that the end of December brought no relief: The company observed state-sponsored and cyber-criminal attackers probing systems for the Log4Shell flaw through month’s end. “Microsoft has observed attackers using many of the same inventory techniques to locate targets. Sophisticated adversaries (like nation-state actors) and commodity attackers alike have been observed taking advantage of these vulnerabilities. There is high potential for the expanded use of the vulnerabilities,” Microsoft security researchers warned.
“Exploitation attempts and testing have remained high during the last weeks of December. We have observed many existing attackers adding exploits of these vulnerabilities in their existing malware kits and tactics, from coin miners to hands-on-keyboard attacks,” the researchers said.
One of the most challenging aspects of responding to the Log4j vulnerability is simply identifying the devices in an organization where Log4j is used. The word “ubiquitous” has applied since the get-go.
“Since it is a cross-platform, widely used software library, there is incredible diversity in where and how it is deployed: it can be an application package installed by itself, bundled with another application package as just another file on disk or embedded in another application with no visible artifact,” J.J. Guy, co-founder and CEO at Sevco Security, told Threatpost on Wednesday.
He added, “Even worse, it is used in everything from cloud-managed services to server applications and even fixed-function, embedded devices. That internet-connected toaster is very likely vulnerable to Log4Shell.”
We’re just in the middle of the triage phase now, Guy said, where basic tools like systems-management or software-management tools to check for the file on disk can provide initial triage.
One question: What’s the inventory of equipment that still needs to be triaged?
“For organizational leaders, such as the board, CEO, CIO or CISO, to have confidence in those triage results requires they report not only the machines that have been triaged but also how many are pending triage,” Guy remarked. “Reporting the ‘pending triage’ statistic requires a complete asset inventory, including which machines have been successfully triaged.”
He called this “one of the larger hidden challenges” in every organization’s response, given that so few have a comprehensive asset inventory, “despite the fact it has been a top requirement in every security compliance program for decades.”
Image courtesy of Quince Media. Licensing details.
PasswordReset:**On-Demand Event:** Fortify 2022 with a password-security strategy built for today’s threats. This Threatpost Security Roundtable, built for infosec professionals, centers on enterprise credential management, the new password basics and mitigating post-credential breaches. Join Darren James, with Specops Software and Roger Grimes, defense evangelist at KnowBe4 and Threatpost host Becky Bracken.Register & stream this FREE session today – sponsored by Specops Software.
commons.wikimedia.org/wiki/File:3D_illustration_image_of_a_gavel_-_auction_hammer_-_free_to_use_in_your_projects_07.jpg
creativecommons.org/licenses/by-sa/4.0/
logging.apache.org/log4j/2.x/security.html
nvd.nist.gov/vuln/detail/CVE-2021-44228
threatpost.com/200k-sign-petition-against-equifax-data-breach-settlement/148560/
threatpost.com/apache-log4j-log4shell-mutations/176962/
threatpost.com/apache-patch-log4shell-log4j-dos-attacks/177064/
threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/
threatpost.com/equifax-says-breach-affects-143-million-americans/127880/
threatpost.com/log4j-attacks-state-actors-worm/177088/
threatpost.com/microsoft-rampant-log4j-exploits-testing/177358/
threatpost.com/microsoft-rampant-log4j-exploits-testing/177358/
threatpost.com/privacy-regulation-could-be-a-test-for-states-rights/138303/
threatpost.com/third-log4j-bug-dos-apache-patch/177159/
threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
threatpost.com/webinars/password-reset-claiming-control-of-credentials-to-stop-attacks/
threatpost.com/zero-day-in-ubiquitous-apache-log4j-tool-under-active-attack/176937/
twitter.com/cisagov/status/1473401212468932609?s=12
www.cisa.gov/uscert/apache-log4j-vulnerability-guidance
www.cisa.gov/uscert/apache-log4j-vulnerability-guidance
www.cisa.gov/uscert/apache-log4j-vulnerability-guidance
www.cisa.gov/uscert/ncas/current-activity/2021/12/17/cisa-issues-ed-22-02-directing-federal-agencies-mitigate-apache
www.ftc.gov/enforcement/statutes/federal-trade-commission-act
www.ftc.gov/enforcement/statutes/federal-trade-commission-act
www.ftc.gov/news-events/blogs/techftc/2022/01/ftc-warns-companies-remediate-log4j-security-vulnerability
www.ftc.gov/tips-advice/business-center/privacy-and-security/gramm-leach-bliley-act
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.7%