Cybersecurity problem

[xsubsailor]

This doesn't mean diddly squat to me but there seems to be a lot of people really excited about it. Maybe someone who speaks the language can explain in layman's terms. 

A flaw in Log4j, a Java library for logging error messages in applications, is the most high-profile security vulnerability on the internet right now and comes with a severity score of 10 out of 10. 

https://www.zdnet.com/article/log4j-zero-day-flaw-what-you-need-to-know-and-how-to-protect-yourself/

[billmeek]

Apache is the most used web server (which runs web sites) in the world.  Many of those use Log4j to log error messages.  As an end user, you don't have control over what's in the cloud and have to trust the vendors to patch the web server.

You can also find web servers in internet connected appliances like routers and TVs.  So it's probably a good idea to update them.  On the PC side of things, unless you are a developer, you normally won't have Log4j running on a computer. 

[xsubsailor]

13 minutes ago, billmeek said:

Apache is the most used web server (which runs web sites) in the world.  Many of those use Log4j to log error messages.  As an end user, you don't have control over what's in the cloud and have to trust the vendors to patch the web server.

You can also find web servers in internet connected appliances like routers and TVs.  So it's probably a good idea to update them.  On the PC side of things, unless you are a developer, you normally won't have Log4j running on a computer. 

Thanks

[MacGyver]

If you work for a company that uses Kronos for workforce management - there’s a decent possibility that you’re going to get a physical paycheck this week because of this vulnerability. 

[Ronald_55]

I just patched a server today for it. My co-worker did another. A third is slated for tomorrow.

This Log4j is in the back end of lots of servers that run web pages for one. So if they get hacked the hacker might have access to the database they run off of or other servers containing key info. For instance the one I patched today could have interfaced with your ATM card in the past. 

I think the big deal is this is very widespread, but is not a software someone installed. It got loaded with other software and people may not even know it is running. We have been running a special scan to find any other machines running it. 

[gregintenn]

16 minutes ago, MacGyver said:

If you work for a company that uses Kronos for workforce management - there’s a decent possibility that you’re going to get a physical paycheck this week because of this vulnerability. 

My wife ran into this where she works.

[Eggplant]

On 12/14/2021 at 4:17 PM, billmeek said:

Apache is the most used web server (which runs web sites) in the world.  Many of those use Log4j to log error messages.  As an end user, you don't have control over what's in the cloud and have to trust the vendors to patch the web server.

You can also find web servers in internet connected appliances like routers and TVs.  So it's probably a good idea to update them.  On the PC side of things, unless you are a developer, you normally won't have Log4j running on a computer. 

So is a software update the best way to guard against this then? I'm not computer savvy to really understand this stuff. It sounds like it more affects companies that use the vulnerability?

[TGO David]

43 minutes ago, Eggplant said:

So is a software update the best way to guard against this then? I'm not computer savvy to really understand this stuff. It sounds like it more affects companies that use the vulnerability?

This one really isn't a problem for the average computer user at home to worry about.

[billmeek]

The biggest concern for a home user is that companies on the Internet are often lax in updating/patching their software.  So it's very likely that some end-user private data may be exposed.  My advice would be to avoid using a debit card online and not use echeck/bank draft either.  As much as I detest credit cards, they usually have much better protection in case of fraud.  Use a credit card if you must make online purchases.