Serious bug puts Apple iCloud, Twitter, Minecraft at hacking threat

11-12-2021 Sat 11:17 IST | IANS | Technology
Serious bug puts Apple iCloud, Twitter, Minecraft at hacking threat

Several popular services, including Apple iCloud, Amazon, Twitter, Cloudflare and Minecraft, are vulnerable to a 'ubiquitous' zero-day exploit, cybersecurity researchers have warned, leaving IT security teams at several companies scrambling to patch the vulnerability called 'Log4Shell'.

The 'zero-day' exploit (which is a cyber attack targeting a software vulnerability which is unknown to the software/antivirus companies) is found in the widely-used Java logging system called 'log4j2'.

If exploited, the vulnerability allows remote code execution (RCE) on vulnerable servers, giving hackers the ability to import malware that would completely compromise millions of machines.

"Many, many services are vulnerable to this exploit. Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable," said researchers from application security company LunaSec.

"Anybody using Apache Struts is likely vulnerable. We've seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach," the researchers noted in a blog post late on Friday.

Many Open Source projects like the Minecraft server, Paper, have already begun patching their usage of 'log4j2'.

According to a TechCrunch report, companies with servers confirmed to be vulnerable to 'Log4Shell' attack so far include Apple, Amazon, Cloudflare, Twitter, Steam, Baidu, NetEase, Tencent and Elastic, "though there are likely hundreds if not thousands of other organisations affected".

In a statement, Cloudflare said it has updated systems to prevent attacks, adding that it saw no evidence of exploitation.

"The Log4j vulnerability is a significant threat for exploitation due to the widespread inclusion in software frameworks, even NSA's GHIDRA," said Robert Joyce, the director of Cybersecurity at the US National Security Agency (NSA).

GHIDRA is a free and open source reverse engineering tool developed by the agency.

The Computer Emergency Response Team (CERT) for New Zealand, Deutsche Telekom's CERT, and the Greynoise web monitoring service have also warned that hackers are actively looking for servers vulnerable to 'Log4Shell' attacks.

The Apache Software Foundation has also released an emergency security update to patch the zero-day vulnerability in 'log4j'.


More News
There will be major changes at national level, says KCR
5 hours ago
Gautam Adani says PM Modi's Aatmanirbhar Bharat best way forward in new global conditions
5 hours ago
Police complaints filed against Telangana BJP chief for hate speech
5 hours ago
Nice to be back in Tamil Nadu, the land of Thiruvalluvar and Bharathi: Modi
6 hours ago
Centre is focused on infrastructure development: Modi
6 hours ago
'Dravidian Model': TN is state of inclusive growth, says Stalin
7 hours ago
PM Modi lays foundation stone for 11 projects worth Rs 31,500 cr in Chennai
7 hours ago
India women's cricket team to tour Sri Lanka in June for white-ball series
9 hours ago
PM Modi arrives in Chennai
9 hours ago
TRS banners with 17 questions greet Modi in Hyderabad
9 hours ago
IPL 2022: Security man lifts a fan who sneaks into field; Kohli reaction goes viral
9 hours ago
Kia to launch electric car with amazing features soon, bookings start
10 hours ago
Rajat Patidar postponed his marriage to take part in IPL 2022 after surprise RCB call-up
10 hours ago
CM Jagan accepted Chandrababu’s proposal of renaming Konaseema district: GVL
10 hours ago
Reform, perform, transform define today's governance: PM Modi
10 hours ago
Vijay Devarakonda, Rashmika sizzle with style at Karan Johar's birthday bash
10 hours ago
Germany approves Bharat Biotech's Covaxin
11 hours ago
KCR, Deve Gowda discuss 'topics of national importance'
11 hours ago
Nation will hear sensational news within 2 to 3 months, says KCR
11 hours ago
Janhvi Kapoor to mark her debut in South with Jr NTR-Koratala film?
11 hours ago