IBM, Amazon, Twitter, Cisco, Apple … just a few of the big players that use the piece of faulty software called Log4J at the center of a major security crisis. Since last Friday, 40% of corporate networks have been targeted by hackers and exposed to over 1.2 million cyber attacks, according to researchers. Security experts are calling the situation “one of the most serious software flaws in recent memory;” a piece from Wired exclaimed, “the internet is on fire.” Below we recap the Log4J disaster and explain why some, such as Midaxo, were not affected.
What is Log4j?
Log4j is an open source software designed to keep a record of activity within an application; basically a logging library that allows developers to see all the activity of an application. Unfortunately, a bug in the software allows hackers to infiltrate infected systems, compromising users’ computers and information. Moreover, in certain cases, worms can spread from one system to another.
What are the impacts of the Log4j breach?
With the breach putting a plethora of organizations’ systems at risk, millions of people’s data is also exposed to hackers (affecting ecommerce at an incredibly busy time of year). This breach highlights the importance of regular security checks and technological security hygiene. In addition, this critical software vulnerability sheds light on the fact that technology and security are often delegated to third party vendors, resulting in some companies not immediately realizing they are at risk and compromised by a software breach.
Midaxo’s Official Statement on the Log4j Security Breach
We have analyzed the impact of the Apache Log4j vulnerability CVE-2021-4428 in the Midaxo environments and performed the recommended mitigation steps.
When the vulnerability was reported, we immediately updated our Web Application Firewalls with the rules, blocking any malicious request trying to exploit the vulnerability. In a detailed investigation, we identified one vulnerable publicly accessible component that has now been patched. In addition, all third-parties related to our product have mitigated the vulnerability.
Midaxo has extensive security monitoring in place. We have not found any evidence of attackers leveraging this vulnerability against us or our customers.
Final Thoughts:
Even after this immediate crisis is addressed and patches are installed (no small task given the widespread use of the Log4j software across a wide range of global companies and governmental agencies), companies cannot become complacent about their internet and digital security…the next attempted software attack by hackers is just around the corner. Cybersecurity must be an essential and critical component of all organizations’ business strategy and daily logistical protocols. Organizations must take a deep dive into their current cybersecurity profile and then proactively address any uncovered weaknesses and potential vulnerabilities before another breach occurs. It would seem that key to this undertaking is the necessity to share findings and approach cybersecurity as a “communal” effort between software developers and all user organizations and systems of like software applications.
