1 in 10 web servers and applications vulnerable to Log4Shell
According to telemetry data from cybersecurity firm Tenable, as of December 21, 2021, only 70% of organizations had even scanned the Log4Shell vulnerability.
Of the assets that were assessed, Log4Shell was found in around 10% – including a wide range of servers, web applications, containers and IoT devices.
While many in the security community are working hard to contain the critical Apache vulnerability, there are concerns that not everyone takes it seriously. Extensive exploitation has already begun, and within a month Tenable CEO and President Amit Yoran expects to see multiple waves of iterations on this exploit, resulting in more aggressive damage that may be impossible to comprehend. stop by then.
“Tenable gathers large amounts of data around each vulnerability, including the recent, highly publicized Log4Shell,” Yoran says.
“What we’ve determined so far is surprisingly, but not surprisingly, 10% of all assessed assets are vulnerable to Log4Shell. Meanwhile, a worrying 30% of organizations haven’t even started researching this bug, a surprisingly negligent delay considering the aggressiveness of the threat actors in pursuit of him.”
It says 1 in 10 enterprise servers are exposed. One in ten of almost every aspect of digital infrastructure has the potential for malicious exploitation via Log4Shell.
“Then there is the number of organizations affected. Our telemetry shows that as of December 21, 2021, only 70% of organizations had even scanned the vulnerability. Log4Shell has been identified as one of the biggest cybersecurity risks we have ever encountered, yet many organizations are still not taking action.”
Yoran claims that 30% of organizations have not begun to assess their environments for Log4Shell, let alone apply patches.
Security professionals are stretched and this is made more difficult due to the holiday schedule, but Yoran believes this risk is unique. “Big exploitation has already begun, and in a month we expect to see multiple waves of iterations on this exploit, resulting in more aggressive damage that may be unstoppable by then,” says -he.
While EternalBlue, for example, has suffered significant attacks, such as WannaCry, the potential here is much greater due to the ubiquity of Log4j in infrastructure and applications.
“No single vulnerability in history has called so blatantly to be fixed,” Yoran says.
“Log4Shell will define computing as we know it, separating those who make the effort to protect themselves and those who are comfortable being careless.”