Connect with us

Tech

Sophos Alerts Businesses As Intelligence Shows Cyberattackers Are Exploiting Apache Log4Shell Vulnerability To Exploit Unpatched Systems

Published

2 years ago

on

Following the reporting of the Apache Log4Shell vulnerability, Sophos has provided new threat intelligence on how cyberattackers are already exploiting or attempting to exploit unpatched systems. 

The threat intelligence as detailed in the SophosLabs Uncut report, Log4Shell Hell: Anatomy of an Exploit Outbreak, shows that Sophos is seeing a rapid uptick in attacks exploiting or attempting to exploit this vulnerability, with hundreds of thousands of attempts detected so far.

The report also indicated that Cryptomining botnets are among the earliest “attack” adopters; botnets focus on Linux server platforms, which are particularly exposed to this vulnerability.

Sophos has also seen attempts to extract information from services, including Amazon Web Services keys and other private data.

The company said it observed that attempts to exploit network services start by probing for different types. 

Around 90 percent of the probes Sophos detected were focused on the Lightweight Directory Access Protocol (LDAP.) A smaller number of probes targeted Java’s Remote Interface (RMI,) but Sophos researchers noted that there seem to be a larger variety of unique RMI-related attempts

Sophos said it expects adversaries to intensify and diversify their attack methods and motivations in the coming days and weeks, including the possibility of leveraging for ransomware. 

According to Sean Gallagher, senior threat researcher at Sophos, in the SophosLabs Uncut report issued on Dec. 9, Sophos has detected hundreds of thousands of attempts to remotely execute code using the Log4Shell vulnerability. 

“Initially, these were Proof-of-Concept (PoC) exploit tests by security researchers and potential attackers, among others, as well as many online scans for the vulnerability. This was quickly followed by attempts to install coin miners, including the Kinsing miner botnet.

The most recent intelligence suggest attackers are trying to exploit the vulnerability to expose the keys used by Amazon Web Service accounts. There are also signs of attackers trying to exploit the vulnerability to install remote access tools in victim networks, possibly Cobalt Strike, a key tool in many ransomware attacks.

“The Log4Shell vulnerability presents a different kind of challenge for defenders. Many software vulnerabilities are limited to a specific product or platform, such as the ProxyLogonand ProxyShellvulnerabilities in Microsoft Exchange. Once defenders know what software is vulnerable, they can check for and patch it.

However, Log4Shell is a library that is used by many products. It can therefore be present in the darkest corners of an organization’s infrastructure, for example any software developed in-house. Finding all systems that are vulnerable because of Log4Shell should be a priority for IT security.

“Sophos expects the speed with which attackers are harnessing and using the vulnerability will only intensify and diversify over the coming days and weeks. Once an attacker has secured access to a network, then any infection can follow.

Therefore, alongside the software update already released by Apache in Log4j 2.15.0, IT security teams need to do a thorough review of activity on the network to spot and remove any traces of intruders, even if it just looks like nuisance commodity malware”, Gallagher added,

New and additional information on how Log4Shell works is also available in the Sophos Naked Security article, Log4Shell Explained – How it Works, Why You Need to Know, and How to Fix It, by Paul Ducklin. 

According to Paul Ducklin, principal research scientist at Sophos:

“Technologies including IPS, WAF and intelligent network filtering are all helping to bring this global vulnerability under control.

But the staggering number of different ways that the Log4Shell ‘trigger text’ can be encoded, the huge number of different places in your network traffic that these strings can appear, and the wide variety of servers and services that could be affected are collectively conspiring against all of us.

The very best response is perfectly clear: patch or mitigate your own systems right now. Our article provides practical advice that explains how the vulnerability works, why it works, what it can do, and how to fix it.”

Related Topics:

Justice Okamgba is journalist at Grassroots.ng

Continue Reading

Tech

Anambra School Emerges Winner In National Girls In ICT Competition With Groundbreaking VR Technology

Published

3 weeks ago

on

April 25, 2024

By

St. John Vianney Science College, Igbariam, used their virtual reality project to conquer the National Girls in ICT Competition 2024, claiming the national championship title yesterday!

The National Girls in ICT Competition, organized by the Federal Ministry of Communication, Innovation and Digital Economy, is a technology innovation competition for all girls in secondary schools across Nigeria.

Their innovative project, M-Tag VR, allows users to explore iconic landmarks like Zuma Rock and learn about fascinating cultural aspects of Nigerian tribes. The girls, Immaculate Ebube Ikegwuonu, Camilla Anyadike, and Nweke-Nonso Oluchi, mentored by their coach, John Onuigbo, triumphed over teams from all 36 states.

The girls’ talent shone brightly throughout the competition. They started at the state level where they aced the Anambra state competition, then proceeded to conquer the Southeastern regional championship, defeating teams from Ebonyi, Imo, Abia, and Enugu, to make it to the national finals.

Rivers and Lagos states secured the second and third-place positions, respectively.

Continue Reading

Tech

Google To Delete Billions Of Browser Records To Settle ‘Incognito’ Lawsuit

Published

1 month ago

on

April 2, 2024

By

CNN reported that Google will delete billions of data records as part of a settlement for a lawsuit that accused the tech giant of improperly tracking the web-browsing habits of users who thought they were browsing the internet privately.

The suit was originally filed in 2020 and accused Google of misrepresenting the kind of data it collects from users who browsed the internet via “Incognito” private browsing mode in Chrome. Google agreed to settle the suit late last year, but the terms of the settlement were first disclosed in a filing on Monday.

As part of the settlement, Google must delete “billions of data records” that reflect the private browsing activities of users in the class action suit, according to court documents filed Monday in San Francisco federal court.

Google will also update its disclosure to inform users about what data it collects each time a user initiates a private browsing session. Google has already started implementing these changes.

For the next five years, Google will also let private browsing users block third-party cookies as part of the settlement. Google also will no longer track people’s choices to browse the internet privately.

Continue Reading

Tech

NIN-SIM Linkage: NCC Directs Telecommunication Operators To Bar Non-Compliant Subscribers

Published

2 months ago

on

March 29, 2024

By

The Nigerian Communications Commission (NCC) has confirmed that it would not be reviewing its deadline to bar owners of more than four SIM cards whose SIM registration data failed to match their National Identity Number (NIN) data.

A source within the Commission explained that the Commission’s position was hinged on its objective to clean the country’s SIM ownership database, and ensure that criminals could not take advantage of having multiple unlinked SIMs to carry out their nefarious activities.

“We are not standing back on our decision. March 29th is sacrosanct. Our resolve is hinged on the need to close in on the chaos of untoward ownership of multiple SIM cards with unverified NIN details. We have instances where a single individual has over 10,000 lines linked to his NIN. In some cases, we have seen a single person with 1,000 lines, some 3,000 plus lines. What are they doing with these lines?

“From our interim findings, the owners of these lines did not purchase them for decent purposes or to undertake legitimate activities.

“We have given them enough time to make the decision of which of their lines they want to keep, and discard the others. They did not. All lines in this category with unverified NINs will be barred. They will be then expected to go to their operators and decide which of the lines they want to keep, as well as submit correct NIN details.

“Some people would say they want to use it for car trackers, or for IoTs, but provision has been made for these services already. They are not under the ‘Max-4 Rule.’

“Across the world, no country allows you to have 1,000 SIM cards to make calls or texts.”

The Max-4 Rule announced by the Federal Government in April 2021 provides that telecom subscribers cannot have more than four lines per mobile network operator.

The NCC has also provided Mobile Network Operators (MNOs) an extension till July 31st 2024 within which they are expected to verify all NINs submitted by subscribers with four (4) or less SIMs, as well as bar those whose NIN fail verification with NIMC.

An authoritative source within the Commission who is familiar with the matter stated that the Commission’s management arrived at the decision at a crucial meeting it held today to review requests from the major Mobile Network Operators requesting for extension for the verification of NINs submitted.

The source also stated that the Commission is mulling the idea to approve an online application solution for MNOs where their subscribers whose NIN verification failed due to biometric mismatch can update their records on the app, while existing subscribers can register additional lines.

Continue Reading

Trending