Tag: Log4Shell

Categories
Mobile Syrup

Apple patched iCloud against massive Log4Shell vulnerability

Late last week, details emerged about a wide-reaching security vulnerability that affected tons of online services and apps, including Apple’s iCloud service. However, the iPhone-maker has reportedly already patched the flaw.

As a refresher, the vulnerability, dubbed ‘Log4Shell,’ impacts an open-source logging library called ‘log4j’ that’s widely used in online services to log events, errors, activities and more. The Log4Shell flaw effectively allowed an attacker to gain access to and execute remote code on servers running log4j simply by getting the logging system to log a specific string of characters.

Due to the wide use of log4j, several major online services are (or were) vulnerable to Log4Shell. Minecraft was among the first platforms impacted by Log4Shell, which saw attackers post chat messages with the specific string to attack servers. A Minecraft patch released Friday fixed the vulnerability.

Other services impacted by Log4Shell included Steam, Twitter, Amazon, Tesla and more. Apple’s iCloud was on the list, but Apple reportedly patched the service on December 11th.

According to The Eclectic Light Company, a blog about Macs and paintings (via Macworld and 9to5Mac), researchers were able to demonstrate the Log4Shell vulnerability when connecting to iCloud through the web on December 9th and 10th. However, the process no longer worked on December 11th.

Ultimately, it appears Apple patched the security flaw in iCloud rather quickly. That’s good news for any iCloud users out there and should be par for the course with large tech companies. There’s also a log4j patch available that helps mitigate the security vulnerability, which should help with patching vulnerable services.

Unfortunately, thanks to the wide-ranging impact of Log4Shell, it will likely take time for all vulnerable services to issue patches.

Source: The Eclectic Light Company Via: Macworld, 9to5Mac

Categories
Mobile Syrup

Apple patched iCloud against massive Log4Shell vulnerability

Late last week, details emerged about a wide-reaching security vulnerability that affected tons of online services and apps, including Apple’s iCloud service. However, the iPhone-maker has reportedly already patched the flaw.

As a refresher, the vulnerability, dubbed ‘Log4Shell,’ impacts an open-source logging library called ‘log4j’ that’s widely used in online services to log events, errors, activities and more. The Log4Shell flaw effectively allowed an attacker to gain access to and execute remote code on servers running log4j simply by getting the logging system to log a specific string of characters.

Due to the wide use of log4j, several major online services are (or were) vulnerable to Log4Shell. Minecraft was among the first platforms impacted by Log4Shell, which saw attackers post chat messages with the specific string to attack servers. A Minecraft patch released Friday fixed the vulnerability.

Other services impacted by Log4Shell included Steam, Twitter, Amazon, Tesla and more. Apple’s iCloud was on the list, but Apple reportedly patched the service on December 11th.

According to The Eclectic Light Company, a blog about Macs and paintings (via Macworld and 9to5Mac), researchers were able to demonstrate the Log4Shell vulnerability when connecting to iCloud through the web on December 9th and 10th. However, the process no longer worked on December 11th.

Ultimately, it appears Apple patched the security flaw in iCloud rather quickly. That’s good news for any iCloud users out there and should be par for the course with large tech companies. There’s also a log4j patch available that helps mitigate the security vulnerability, which should help with patching vulnerable services.

Unfortunately, thanks to the wide-ranging impact of Log4Shell, it will likely take time for all vulnerable services to issue patches.

Source: The Eclectic Light Company Via: Macworld, 9to5Mac

Categories
Mobile Syrup

Security flaw in widely-used logging system impacts Minecraft, iCloud, more

A massive security vulnerability dubbed ‘Log4Shell’ that potentially impacts millions of devices has security teams scrambling to apply patches.

The vulnerability affects an open-source logging library called ‘log4j’ used by apps and services across the internet, according to The Verge. Logging, for those not familiar, is a common process where apps keep a running list of activities they perform that can be reviewed later in case of an error. Nearly every network security system runs some kind of logging process — that gives libraries like log4j significant reach and, by extension, huge impact when there’s a vulnerability like this.

The log4j flaw could allow remote code execution on vulnerable servers if exploited. That could give attackers the ability to import malware that would compromise machines.

Worse, the vulnerability is fairly easy to exploit. Attackers need to make an application save a special string of characters in the log — since apps often log a range of events, covering everything from chat messages to system errors — it’s not hard to inject the string.

For example, the exploit was first spotted on sites hosting Minecraft servers. Those sites discovered that attackers could trigger Log4Shell by posting chat messages. A new version of Minecraft that rolled out Friday includes a patch for the vulnerability.

However, Minecraft is far from the only impacted service. A blog post from security company LunaSec claims that Valve’s popular PC gaming platform Steam and Apple’s iCloud are both vulnerable to Log4Shell. Other vulnerable platforms will likely be discovered in the coming weeks.

The Verge reports that an update released for the log4j library mitigates the vulnerability. However, considering the sheer number of impacted apps and services, and the time it’ll take to update everything, Log4Shell will remain a significant problem.

Source: Ars Technica, The Verge