Waikato, Public university in Hamilton, New Zealand

New Delhi, Dec 11 Several popular services, including Apple iCloud, Amazon, Twitter, Cloudflare and Minecraft, are vulnerable to a 'ubiquitous' zero-day exploit, cybersecurity researchers have warned, leaving IT security teams at several companies scrambling to patch the vulnerability called 'Log4Shell'.The 'zero-day' exploit (which is a cyber attack targeting a software vulnerability which is unknown to the software/antivirus companies) is found in the widely-used Java logging system called 'log4j2'.If exploited, the vulnerability allows remote code execution (RCE) on vulnerable servers, giving hackers the ability to import malware that would completely compromise millions of machines."Many, many services are vulnerable to this exploit. Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable," said researchers from application security company LunaSec."Anybody using Apache Struts is likely vulnerable. We've seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach," the researchers noted in a blog post late on Friday.Many Open Source projects like the Minecraft server, Paper, have already begun patching their usage of 'log4j2'.According to a TechCrunch report, companies with servers confirmed to be vulnerable to 'Log4Shell' attack so far include Apple, Amazon, Cloudflare, Twitter, Steam, Baidu, NetEase, Tencent and Elastic, "though there are likely hundreds if not thousands of other organisations affected".In a statement, Cloudflare said it has updated systems to prevent attacks, adding that it saw no evidence of exploitation."The Log4j vulnerability is a significant threat for exploitation due to the widespread inclusion in software frameworks, even NSA's GHIDRA," said Robert Joyce, the director of Cybersecurity at the US National Security Agency (NSA).GHIDRA is a free and open source reverse engineering tool developed by the agency.The Computer Emergency Response Team (CERT) for New Zealand, Deutsche Telekom's CERT, and the Greynoise web monitoring service have also warned that hackers are actively looking for servers vulnerable to 'Log4Shell' attacks.The Apache Software Foundation has also released an emergency security update to patch the zero-day vulnerability in 'log4j'.Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor

WaikatoFOLLOW

Waikato, Latest News

Wellington, Dec 21 New Zealand's medicine regulator on Tuesday approved a new Covid-19 medicine Ronapreve, which can both ... ...

Wellington, Dec 21 The New Zealand government on Tuesday urged parents and caregivers to consider protecting their children ... ...

Mumbai, Dec 20 New Zealand pacer Tim Southee has revealed that sharing the cricketing field alongside legendary Indian ... ...

Wellington, Dec 14 Food prices in New Zealand fell 0.6 per cent in November compared to the previous ... ...

Game fanatics have a reason to rejoice as for the first time, Sony on Monday announced its range of first-party console covers for the PlayStation 5 and also three new colours for the DualSense controller. ...

New Delhi, Dec 13 Cyber security researchers on Monday warned that hackers are making over 100 attempts every ... ...

Mumbai, Dec 13 Having Rahul Dravid as the head coach is the most "amazing" thing to have happened ... ...

New Delhi, Dec 11 Several popular services, including Apple iCloud, Amazon, Twitter, Cloudflare and Minecraft, are vulnerable to ... ...