What is Log4j, the biggest computer vulnerability in decades?

Log4Shell, a critical security flaw in Log4j, an open source logging software used in everything from online games to enterprise software and cloud data centres, has security teams all over the world scrambling to fix it.

Because of its widespread use, the internet has been put on high alert as hackers increase their efforts to target weak systems. 

What exactly is the Log4j vulnerability? 

The vulnerability, also known as Log4Shell, was first discovered by LunaSec researchers.

The flaw was identified in Microsoft's Minecraft, but LunaSec warns that because of Log4j's "ubiquitous" presence, "many, many services" are vulnerable to this exploit.

The reason for this is that practically every major Java-based enterprise software and server on the market uses this open-source Java library. 

Also read | Software flaw 'Log4Shell' may be worst computer vulnerability in a decade

Why is dealing with Log4j such a difficult task? 

Hackers are attempting over 100 times per minute to exploit a serious security weakness in the widely used Java logging system known as 'Apache log4j2,' according to cyber security researchers, putting millions of firms at danger of cyber theft.

This 'ubiquitous' zero-day attack, currently regarded as one of the most significant vulnerabilities on the Internet in recent years, affects a number of famous sites, including Apple iCloud, Amazon, Twitter, Cloudflare, and Minecraft.

Many types of enterprise and open-source software, including cloud platforms, online applications, and email services, employ 'Apache Log4j.'

With over 400,000 downloads from its GitHub repository, Apache Log4j is the most popular java logging package.

It is used by a large number of enterprises throughout the world and allows users to log in to a variety of popular applications. 

Researchers at Microsoft have also warned about attacks attempting to take advantage of `Log4j` vulnerabilities, including a range of crypto-mining malware.

Also Read: Songs by virus: Company selling COVID-19 sound for NFT

What is the severity of the flaw? 

As the number of companies and services affected by Log4Shell rises, so does the number of attacks that take advantage of the flaw.

Kryptos Logic, a security firm, also announced on Sunday that it has discovered more than 10,000 different IP addresses scanning the internet, which is 100 times the amount of systems probing for Log4Shell on Friday.

Given Log4Shell's broad scope and the potential of ransomware following, this is most certainly the calm before the storm.

Every security team's primary priority should be patching or minimising the vulnerability. 

(With inputs from agencies)