Incredibly screwed. The log4j exploit is a 10/10 on the common vulnerability scoring system. I.e. time to care. gizmodo.com/log4j-just-how…
"Apache’s log4j, is a free and open-source logging library that droves of companies use. It's free and widely trusted, companies large and small have been employing it for all kinds of stuff. The irony, of course, is that this bug-checking tool now has a bug"
"afflicted include big names like Apple, Twitter, Amazon, LinkedIn, CloudFlare. Cloud computing firm VMWare, for instance, reports that 44 of its products are impacted. Networking giant Cisco says that 35 of its tools are vulnerable"
"So, that’s the bad news. The good news? JK, there isn’t any good news. Instead, there’s more bad news: This gaping vulnerability is already seeing mass exploitation attempts by hordes of cybercriminals."
"most criminals appear to have found out about the log4j vuln at the same time as everybody else. Thus, exploitation attempts on vulnerable systems and platforms have increased exponentially since last week"
"Dec 10th saw 1000s of attack attempts, rising to over 40,000 Dec 11th. 24h after the outbreak we recorded 200,000 attempts of attack.
As of the time these lines are written, 72 hours post initial outbreak, the number hit over 800,000 attacks"
As of the time these lines are written, 72 hours post initial outbreak, the number hit over 800,000 attacks"
“We’re seeing >1,000 attempted exploits per second. And payloads getting scarier. Ransomware payloads started in force in last 24 hours”
"If you’re a casual web user, the only thing you can really do at this point is to update your devices and applications when prompted and hope that the platforms you’re relying on are speedy enough to identify the vulnerabilities, conjure up patches, and push out updates"
The great walk-through was done by @LucasRopek1 at @Gizmodo.
@threadreaderapp unroll plz
• • •
Missing some Tweet in this thread? You can try to
force a refresh
