Log4j And The Societal Threat Posed By Open Source Vulnerabilities

What Is the Log4j Vulnerability?

Log4j is free and open source software used by thousands of websites and business applications worldwide. These applications and services include well-known companies such as Apple iCloud, Microsoft Minecraft, and Oracle databases. The use of log4j is ubiquitous in the Java world, making the Log4j vulnerability very severe.

Security vulnerabilities were recently discovered in Log4j that could allow an attacker to remotely execute malicious code on a target computer. This means that an attacker can easily steal data over the Internet, install malware, or take control of millions of computer systems.

According to research from Check Point, more than 800,000 exploit attempts were detected in the first 72 hours after the Log4j issue was made public. The widespread impact of this vulnerability is so great that it will take years to fix, because over 95% of Java programs use Log4j either directly or indirectly.

The Common Vulnerability Scoring System (CVSS), an industry-standard vulnerability severity ranking method, gave the Log4j vulnerability the maximum possible score of 10 out of 10—equivalent to an earthquake scoring 10 on the Richter scale. The vulnerability created ripple effects within and beyond the IT industry, and led to the exposure of many related vulnerabilities that were previously unknown.

Open Source Security in the Wake of the Log4j Vulnerability

Major vulnerabilities like Log4j can make open source software appear less secure. However, commercial and open source code is equally susceptible to weaknesses, and commercial software also often uses open source components. This makes vulnerability management a critical component of modern information security.

The main difference is that anyone can identify issues in open source. In some cases, the vulnerabilities are not in the code itself but the implementation (i.e., configuration). What matters is the community’s effort to find and address vulnerabilities. Users should treat open source technology differently from commercial products—there is no clear person responsible for addressing issues.

Anyone can, and should, modify open source code as they see fit to fix security issues or improve functionality. Everything in the open source world relies on voluntary contributions. If a business benefits from the open source community’s efforts for free, it should also be willing to contribute. Active participation is essential to keep up with updates and apply security fixes when they become available.

Another issue with open source software is that many organizations implicitly trust it, allowing developers to download code and use it without making changes. They don’t apply the same stringent security standards and reviews to open source as to their proprietary software.

Regarding the Log4j vulnerability, the Apache team working on Log4j took the issues seriously and responded to the needs of diverse users. The contributors demonstrated a high degree of responsibility for the project. But this reaction comes only after the damage is done, and there is no guarantee that open source contributors responsible for the next security calamity will be as vigilant.

Log4j Is the Tip of the Iceberg

Log4j is not the problem—rather, it represents a symptom of the inherent risks of open source software. Open source is ubiquitous because it is convenient, but attackers can access the code as freely as developers. They can scour open source projects for vulnerabilities to exploit and target the organizations using the vulnerable code.

While open source contributors tend to be active and fix issues regularly, many businesses using open source software fail to implement the patches. There is no vendor to upgrade the software for its customers automatically. Attackers know that many organizations cannot apply all the patches in time.

Attackers often exploit vulnerabilities immediately when they discover them, hiding malicious functions in their target’s network and collecting information discreetly via sleeper cells. In some cases, attackers wait for weeks or months to launch an attack (e.g., ransomware), allowing them to learn about the victim and cause more damage.

Major tech companies have launched initiatives to address the inherent risk of open source vulnerabilities. Google pledged $100 million to open source security teams, and CISA (the Cybersecurity and Infrastructure Security Agency) collaborates with government agencies to help improve the implementation of patches. However, each organization is ultimately responsible for its own security.

Who Will Be Hurt Most by Open Source Security Defects?

Open source security has an impact on the entire global economy. However, large and technology savvy organizations have the resources to protect their own infrastructure. They will be hurt by future vulnerabilities, but will speedily recover.

The situation is different with small businesses, or even larger businesses that have not undertaken digital transformation. Think of manufacturing plants or retail chains whose staff are not technically savvy, who may be running computer systems with outdated operating systems, and who have limited understanding of the importance of cybersecurity hygiene.

Some of the most devastating ransomware attacks—for example the JBL Foods attack that shut down some of the world’s biggest slaughterhouses on three continents—were waged against companies like these.

“Low tech” businesses employ a large fraction of the adult population. According to Statistica, 53 million Americans are employed in the trade, manufacturing, construction, transportation, and agriculture industries. Many of these organizations are easy, stationary targets for cyberattackers. They are unaware of their security weaknesses, likely don’t have the tools to detect an attack, and will have limited ability to contain and recover an attack when it occurs.

A new digital divide is emerging. Just like physical disasters hurt the disadvantaged most, cyber disasters will be devastating for organizations that are unaware and poorly prepared. Companies that are already at a competitive disadvantage, due to lack of technological capital and skills, are at the mercy of cybercriminals. A cyberattack, which is damaging for any organization, can deal these already fragile organizations a death blow.

There is no simple solution—technology is entering every part of business life, cybercriminals are becoming more sophisticated, and the tools to defend against them are beyond the reach of many. Perhaps what is needed is a cybersecurity “welfare state”—a government sponsored program to provide all businesses a basic level of protection against a harsh cyber reality.

This article does not necessarily reflect the opinions of the editors or management of EconoTimes