NEW: #Log4j vulnerability "extremely concerning" per @CISAgov Exec Asst Director for Cybersecurity Eric Goldstein
Log4j library "widely used in a variety of devices & products, both consumer & enterprise, across sectors & across functions" he says
Log4j library "widely used in a variety of devices & products, both consumer & enterprise, across sectors & across functions" he says
#Log4j vulnerability "extremely easy to exploit & new ways to exploit it are being reported continuously over the last several days" per @CISAgov's Goldstein "Exploiting this vulnerability gives an adversary potentially deep access into a target"
"We have seen a wide range of threat activity" due to #Log4j, per @CISAgov's Goldstein "It has largely been low level activity such as crypto miners. But we do expect that adversaries of all sorts will utilize this vulnerability to achieve their strategic goals"
"We are seeing broad reports now of some other actors potentially using this vulnerability for other types of attacks. But those as yet are unconfirmed" per @CISAgov's Goldstein
"We have no confirmed instances of federal agencies that have been compromised" per @CISAgov's Goldstein re #Log4j
"These are products that are used by every major organization around the world...likely the case that federal agencies are indeed utilizing some of these products"
"These are products that are used by every major organization around the world...likely the case that federal agencies are indeed utilizing some of these products"
"At this point we are not able to attribute any activity related to this vulnerability to specific actors" per @CISAgov's Goldstein re #Log4j
"We are not seeing widespread highly sophisticated damaging intrusion campaigns" per @CISAgov's Goldstein re #Log4j
"Certainly we are deeply concerned abt the prospect of adversaries using this vulnerability to cause real harm & even impacting national critical functions"
"Certainly we are deeply concerned abt the prospect of adversaries using this vulnerability to cause real harm & even impacting national critical functions"
"Critical infrastructure organizations are taking urgent mitigation steps, including patching products where available...& thus far hve been able to do so w/out material impacts to their critical functions or services" per @CISAgov's Goldstein re #Log4j
"At this point we are not seeing any impact on national critical functions" per @CISAgov's Goldstein
Overall, "our estimate is that certainly hundreds of millions of devices are likely impacted" by #Log4j, per @CISAgov's Goldstein
"That number will change as more vulnerable products are possibly identified"
"That number will change as more vulnerable products are possibly identified"
• • •
Missing some Tweet in this thread? You can try to
force a refresh
