WHAT IS THE LOG4J EXPLOIT AND WHAT YOU CAN DO TO SAFEGUARD YOUR DATA?

The North Group Global Security Operations Center and its senior intel team have been investigating risks associated with the Log4j exploit, alternatively named Log4Shell or CVE-2021-44228. This exploit has recently made headlines in mainstream media for its potential catastrophic effects on corporations and individuals. Some notable names already affected by this exploit include, but are not limited to Amazon, IBM, HCL, Cisco and Okta. It’s not just companies, individual users who utilize Windows, Linux and iOS are also affected. This is such a major issue that the Federal Trade Commission (FTC) has issued a warning to all companies affected, to patch Log4j or to be prepared for lawsuit. The question is, how did this happen? More importantly, how can you protect your interests from quite possibly the largest cyber-security exploit in history?

Our first order of business should be to understand what Log4j is. Most people make the mistake of thinking it’s a virus. Log4j is not a virus, it is a data logging tool that’s used in most software and is currently affecting PC, MAC and Linux users worldwide. Log4j is written in Java, which means it doesn’t inherently have protections like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). The software is an open-source package. That means any one can read the source code, spot bugs, and edit the package itself. The vulnerability was discovered on November 24, 2021. Since that day, hackers have exploited this vulnerability and are able to bypass any sort of administrative restrictions in an effort to gain system access without a password. Once criminal organizations and adversarial hackers have the access, they are able to install malicious software, observe confidential or classified information, and steal said sensitive information.

Since receiving negative media attention, Log4j has since been updated to version 2.16 to circumvent the threat vulnerability; However, any system using any version before 2.16 is still at risk. Unfortunately, most systems do not have the updated version. So, what can someone do to protect themselves from this seemingly inevitable threat? Sadly, there is nothing to provide a 100% safeguard of your data until your system is updated to the current version of Log4j. Unfortunately, most operating systems have a life span that’s not due for updating for six months or even longer. Log4j is code designed for servers, and the exploit attack affects servers and the end user’s information. You may be affected indirectly if a hacker uses it to take down a server that interacts with systems you operate on or tries to use the server for drive-by downloads or other malicious malware attacks.

There’s nothing that can really be done to circumvent a potential server takedown, but you can safeguard against those secondary attacks by using some of these “back-to-basic” strategies that cyber experts swear by.

1. Installing a powerful antivirus utility and keeping it updated
   1. Antivirus software is a program that works against a virus. It detects or recognizes the virus, and then after detecting the presence of the virus, it works on eliminating it from the computer system. Antivirus software works as a prophylactic so that it not only eliminates a virus but also prevents any potential virus from infecting your computer in the future.
2. Do your part by staying alert for phishing frauds
   • Phishing is the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers. If an email is urging you to click a link, it is best to verbally confirm from the said individual that the email was sent intentionally.
3. Use a password manager
   • Weak or stolen passwords are responsible for 81% of data breaches, making them a big security concern for any company. Using a password management app can greatly increase your company’s cybersecurity by helping users create strong and unique passwords for every login and enforcing other security best practices.
4. Run your internet traffic through a Virtual Private Network, or VPN.
   • A virtual private network (VPN) gives you online privacy and anonymity by creating a private network from a public internet connection. VPNs mask your internet protocol (IP) address, so your online actions are virtually untraceable.
5. Update your PC and software when prompted
   • Software updates are important because they often include critical patches to security holes. In fact, many of the more harmful malware attacks we see take advantage of software vulnerabilities in common applications, like operating systems and browsers. So instead of procrastinating about software updates, see those updates as one of the most essential steps you can take when it comes to protecting your information.

Keeping your own data, devices, and connections secured means you’re unlikely to be affected by the fallout from a Log4j exploit attack. However, if you do become a victim or are fearful that could happen, The North Group is here to help. We mitigate current events, plan for the detection, and stand ready to deploy experts for crisis management purposes at a moment’s notice. Our management team has a passion for solving the most complex problems. Contact us today at solutions@tngdefense.com or (844) 750-9222. Continue to visit our site for more blogs and useful tips.