https://www.channelfutures.com/wp-content/themes/channelfutures_child/assets/images/logo/footer-new-logo.png
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
Channel Futures
  • NEWSLETTER
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
    • Newsletter
  • REGISTER
  • MSPs
  • VARs / SIs
  • Agents
  • Cloud Service Providers
  • Channel Partners Events
 Channel Futures

MSSP Insider


Shutterstock

Vulnerability

Nation-States Pounce on Easy-to-Exploit Log4Shell Software Vulnerability

  • Written by Edward Gately
  • December 16, 2021
The discovery of the Log4Shell software vulnerability could not have come at a worse time.

Nation-states such as Iran, China and North Korea are actively looking for ways to exploit the Log4Shell software vulnerability.

NCA's Lisa Plaggemier

NCA’s Lisa Plaggemier

That’s according to Lisa Plaggemier, interim executive director of the National Cybersecurity Alliance (NCA). Last week, researchers discovered a zero-day exploit in the popular Java logging library log4j. It results in remote code execution (RCE) by logging a certain string.

UKG, the parent company of human resources management company Kronos, has been hit with ransomware. Although the company isn’t confirming it, reports suggest the ransomware attack exploited the Log4Shell software vulnerability.

Thousands of applications, libraries and frameworks use log4j.

CloudFlare, Minecraft, SMBs Impacted

“Unfortunately, the ramifications of this vulnerability have proven to be just as far-reaching as many had anticipated,” Plaggemier said. “Businesses ranging from Apple’s CloudFlare and Minecraft to SMBs have all been impacted by this vulnerability, and are working incredibly rapidly to patch it. The good news is that Apache has made a patch readily available. And many companies including IBM, AWS and many others, have been keeping their customers apprised of progress around the situation. However, this has certainly been incredibly concerning for those impacted and is definitely a black eye for such a widely used and trusted tool.”

On its website, CloudFlare urges any customers using log4j to update to version 2.16.0 as soon as possible.

“To make matters worse for those affected, it has been uncovered that nation-states such as Iran, China and North Korea, have all begun looking into ways to exploit this vulnerability – if they haven’t already,” Plaggemier said. “And regrettably it seems that this could only be the tip of the iceberg as cybercriminals look for similar vulnerabilities in related tools.”

From a timing perspective, the discovery of the Log4Shell software vulnerability could not have come at a worse time, she said.

“With the typical surge of online shopping around the holidays, paired with the ongoing fallout of the COVID-19 pandemic and the supply chain gridlock, another disruption is the last thing businesses need right now,” Plaggemier said. “Therefore, it is really important that Apache continues to do everything it possibly can to get patches installed as quickly as possible.”

Long-Play Vulnerability

Sophos' Sean Gallagher

Sophos’ Sean Gallagher

Sean Gallagher is senior threat researcher at Sophos.

“We are tracking attempts, but we have no specific information on victims of the exploit working at this time,” he said. “This is a long play vulnerability, and we may not know who was affected for weeks or months.”

There are indications from other sources that some advanced persistent threats (APTs) have been trying to use the exploit, Gallagher said.

This is a vulnerability that would lend itself to espionage or state-sponsored attacks, he said.

Sophos sees the number of overall probes going down, Gallagher said. But that’s likely the result of reduced mass-scanning and more targeted attempts.

“The danger remains the same,” he said. “If you’ve checked and found your Java-based server applications are currently not vulnerable, but you’re running the previous version of log4j 2.x, you need to determine if you patched it or if an external actor did after exploiting it.”

There’s already been previous patterns of ransomware during the holidays, Gallagher said.

Want to contact the author directly about this story? Have ideas for a follow-up article? Email Edward Gately or connect with him on LinkedIn.
Tags: MSPs Best Practices Channel Research Cloud MSSP Insider Security

Most Recent


  • Phishing
    Twilio Customers' Data Stolen in Phishing Attacks that Trick Employees
    The hackers impersonated Twilio's IT department.
  • Beyond Pride
    'Beyond Pride,' a Free DE&I Webinar on Workplace Culture for LGBTQ+
    Allies and awareness are key to helping LGBTQ+ employees feel safe.
  • Navigate business
    How Partners Can Navigate Economic Uncertainty, Possible Recession Ahead
    The biggest mistake is companies waiting too long to reduce costs.
  • private
    Vista Equity Partners Buying Avalara for $8.4 Billion, Taking It Private
    When completed, Avalara’s shares will no longer trade on the New York Stock Exchange.

Leave a comment Cancel reply

-or-

Log in with your Channel Futures account

Alternatively, post a comment by completing the form below:

Your email address will not be published. Required fields are marked *

Related Content

  • no passwords
    Beyond Identity Urges Channel to Capitalize on Demand for Passwordless
  • Skull with code background
    Alternative Attack Vector Discovered for Log4J Vulnerability
  • Security Vulnerability
    Log4Shell Vulnerability To Have Massive Impact Into 2022 And Beyond
  • Pile of Cash
    Cequence Security Lands $60 Million to Protect APIs, ‘A New Attack Vector’

Upcoming Events

View all

MSP Summit

September 13, 2022 - September 16, 2022

Channel Partners Conference & Expo

May 1, 2023 - May 4, 2023

Galleries

View all

Images: Telarus Hosts Partner Summit, Gives Partner, Supplier Awards

August 5, 2022

7 Channel People Making Waves This Week at Kaseya, AT&T, Cohesity, More

August 5, 2022

The Gately Report: Zscaler Tracks New, Increasingly Dangerous Ransomware Group, Most Targeted Types of People

August 5, 2022

Industry Perspectives

View all

Seize the Application Modernization Opportunity

August 2, 2022

A Growth Mindset: Your Organization’s Strategic Differentiator

August 1, 2022

Timely Tips for Non-Negotiable Patch Updates

July 29, 2022

Webinars

View all

Outsmarting RaaS: Implementation Strategies To Help Your Clients Before, During, and After a Ransomware Attack

August 23, 2022

Why it is Important to Upgrade Aging Servers and How to use Live Optics to Upgrade Efficiently

August 25, 2022

Executives at Home are Not Alright: An Intro to Digital Executive Protection

September 8, 2022

White Papers

View all

Work Goes Remote – (and Other Top ITOps Trends)

May 25, 2022

The New Bottom Line: How MSPs Can Meet the Healthcare Crisis While Evolving Their Businesses

April 19, 2022

How to build a Security Operations Center (on a budget)

April 4, 2022

Channel Futures TV

View all

Vonage a ‘Single Communications Stack Provider’ for Partners, Customers

IBM, Partners and the $1 Trillion Hybrid Cloud Opportunity

June 26, 2022

Agents Share ‘Secrets,’ Industry Opportunity

May 11, 2022

AT&T, Microsoft, Cisco, ThreatLocker on Unlocking Partner Potential

May 6, 2022

Twitter

ChannelFutures

Bret Hickenlooper of @sumocom is more excited than ever to be in the channel. dlvr.it/SWHhP1 https://t.co/S0YfM2Vpiw

August 8, 2022
ChannelFutures

.@Vista_Equity acquiring @avalara in $8.4 billion deal. #automation dlvr.it/SWHd98 https://t.co/klle3bZMMp

August 8, 2022
ChannelFutures

Hackers access @twilio customer data via #phishing attacks. dlvr.it/SWHWXn https://t.co/dV9bal0vGS

August 8, 2022
ChannelFutures

[email protected] produced a 50-minute webinar on creating a work culture in which LGBTQ+ employees feel safe. You can… twitter.com/i/web/status/1…

August 8, 2022
ChannelFutures

#MSPSummit preview: Surviving, thriving during economic rough seas with @SL-Index's Peter Kujawa.… twitter.com/i/web/status/1…

August 8, 2022
ChannelFutures

.@ConnectWise says use #cyberinsurance policies to protect from worst of cyberattack repercussions, but first beef… twitter.com/i/web/status/1…

August 8, 2022
ChannelFutures

Check out our pictures from the #TelarusPartnerSummit that @telarus hosted in Salt Lake City.… twitter.com/i/web/status/1…

August 5, 2022
ChannelFutures

Channel People Making Waves This Week Include: @spoonen, @RoyArsan, @TheAnneChow, @AnuragTechaisle… twitter.com/i/web/status/1…

August 5, 2022

MSP 501

The industry's largest and most comprehensive partner awards program.

Newsletters and Updates

Sign up for The Channel Report, Channel Futures Update, MSP 501 Newsletter and more.

Live Channel Events

Get the latest information on the next industry-leading Channel Partners event.

Galleries

Educational slide shows and images from live events.

Media Kit And Advertising

Want to reach our audience? Access our media kit.

DISCOVER MORE FROM INFORMA TECH

  • Channel Partners Events
  • Telecoms.com
  • MSP 501
  • Black Hat
  • IoT World Today
  • Omdia

WORKING WITH US

  • Contact
  • About Us
  • Advertise
  • Newsletter

FOLLOW Channel Futures ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2022 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.
This website uses cookies, including third party ones, to allow for analysis of how people use our website in order to improve your experience and our services. By continuing to use our website, you agree to the use of such cookies. Click here for more information on our Cookie Policy and Privacy Policy.
X