{"id":427204,"date":"2021-12-13T11:15:16","date_gmt":"2021-12-13T09:15:16","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=427204"},"modified":"2021-12-17T14:00:52","modified_gmt":"2021-12-17T12:00:52","slug":"critical-security-flaw-being-exploited-all-over-the-internet","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/427204-critical-security-flaw-being-exploited-all-over-the-internet.html","title":{"rendered":"Critical security flaw being exploited all over the Internet"},"content":{"rendered":"

IT security company Sophos has detected<\/a><\/strong> a sharp increase in attacks exploiting the zero-day exploit in Apache’s Log4j<\/a><\/strong>.<\/p>\n

Vulnerable organisations include<\/a><\/strong> Apple, Tencent, Valve, Google, Minecraft, Amazon, and Tesla, to name a few.<\/p>\n

The exploit, dubbed Log4Shell and tracked as CVE-2021-44228, was initially detected by LunaSec<\/a><\/strong> on 9 December 2021. It allows an attacker to inject log messages or message parameters into server logs that load code from a remote server.<\/p>\n

The infected server will then run that code via calls to the Java Naming and Directory Interface (JNDI).<\/p>\n

Sophos also expects malicious actors to intensify and diversify their attack methods and possibly introduce malware in the near future.<\/p>\n

“Since Dec. 9, Sophos has detected hundreds of thousands of attempts to remotely execute code using the Log4Shell vulnerability,” said Sophos senior threat researcher Sean Gallagher.<\/p>\n

Sophos found that crypto mining botnets are some of the earliest to exploit the vulnerability. They tend to focus on Linux server platforms that are vulnerable to the exploit.<\/p>\n

“Initially, these were Proof-of-Concept (PoC) exploit tests by security researchers and potential attackers, among others, as well as many online scans for the vulnerability,” Gallagher said.<\/p>\n

“This was quickly followed by attempts to install coin miners, including the Kinsing miner botnet.”<\/p>\n

The IT security company’s investigations also revealed attempts to retrieve information from services such as account information for Amazon Web Services and other private data.<\/p>\n

\n

looked at related network traffic, I am thinking that this is likely from a Find My iPhone related server (iOS sends it updated device name it appears).<\/p>\n

as of this moment, I am also suddenly no longer able to reproduce this.<\/p>\n

\u2014 Will Strafach (@chronic) December 11, 2021<\/a><\/p><\/blockquote>\n