{"id":10983,"date":"2021-12-13T18:40:03","date_gmt":"2021-12-13T16:40:03","guid":{"rendered":"https:\/\/cosh.de\/beitraege\/attention-federal-office-warns-about-massive-and-dangerous-it-security-vulnerability-log4j\/"},"modified":"2022-04-27T15:11:48","modified_gmt":"2022-04-27T13:11:48","slug":"attention-federal-office-warns-about-massive-and-dangerous-it-security-vulnerability-log4j","status":"publish","type":"post","link":"https:\/\/cosh.de\/en\/attention-federal-office-warns-about-massive-and-dangerous-it-security-vulnerability-log4j\/","title":{"rendered":"Attention: Federal Office warns about massive and dangerous IT security vulnerability “Log4j"},"content":{"rendered":"

Attention: Federal Office warns about massive and dangerous IT security vulnerability “Log4j<\/h2><\/p>\n<\/div>
Dear Sir or Madam,<\/strong><\/div>\n
<\/div>\n
over the weekend, the BSI (German Federal Office for Information Security) published a letter about a very threatening vulnerability in an open source software called Log4j.<\/div>\n
<\/div>\n

https:\/\/www.bsi.bund.de\/SharedDocs\/Cybersicherheitswarnungen\/DE\/2021\/2021-549032-10F2.pdf?__blob=publicationFile&v=3<\/p>\n

<\/a><\/div>\n

<\/div>\n
The vulnerability has a threat score:<\/strong> 10 out of 10<\/strong><\/div>\n<\/div>
<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>\n
Description:<\/span> <\/span><\/b><\/div>\n
\n

log4j is a framework for logging application messages in Java. Within many open source and commercial software products, it has become a de facto standard over the years. log4j is considered a pioneer for other logging frameworks, even in other programming languages.<\/p>\n

What does this mean in plain language:<\/b><\/p>\n

Currently, hackers from all over the world are trying to scan systems accessible from the Internet to detect the vulnerability. Our customers and ourselves will also be affected by these scans.<\/p>\n<\/div>\n<\/div>

<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>\n
The bad news first:<\/span> <\/span><\/b><\/div>\n
\n

The above technology is used by just about every major software vendor in some of their products: VMWare, Cisco, Unifi, SAP, and and and.<\/p>\n

If the vulnerability is found, it can be exploited to execute unrestricted code on the target system. This means you can do whatever you want with the system. e.g. copy the complete customer database, steal patents or spy out access data, e.g. for online banking.<\/p>\n<\/div>\n<\/div>

<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>\n
The good news:<\/span> <\/span><\/b><\/div>\n
\n

CosH’s IT security team has been busy analyzing the vulnerability since Sunday.<\/p>\n

The most important thing is that you and your colleagues remain calm.<\/p>\n<\/div>\n<\/div>

<\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>\n
One of the biggest problems with the vulnerability is that the Log4J software (or framework) is used by just about every software vendor. This means that not only the base of IT we manage is affected, but probably many of the programs you use on a daily basis.<\/div>\n
\n<\/div>\n<\/div>
<\/div>
<\/div><\/div><\/div><\/div><\/div>
Customers who have active Managed Firewall and Managed Endpoint Security or SD WAN service contracts with us are gone through customer by customer.<\/strong><\/div>\n
<\/div>\n
We proceed as follows:<\/strong><\/div>\n
\n
    \n
  1. Analysis of security protocols from firewall and endpoint security<\/li>\n
  2. In case of suspicion or finding of incidents we contact you proactively by phone<\/li>\n
  3. We discuss the next steps by phone<\/li>\n<\/ol>\n
    We discuss the next steps by phone<\/div>\n
    <\/div>\n
    \n
    Please refrain from contacting our technicians directly by phone on the subject, we need all resources for the security checks.<\/strong><\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>
    <\/div>
    <\/div><\/div><\/div><\/div><\/div>
    \n

    So you can check via your vendor if your software uses Log4J:<\/p>\n<\/p>\n

      \n
    1. Open Google<\/li>\n
    2. Enter the following CVE code + the name of your software e.g.<\/li>\n
    3. CVE-2021-44228 SAP<\/li>\n
    4. If the manufacturer already has information about the gap, you will find something about it on the website.<\/li>\n
    5. Follow the information and order the installation of updates for your software<\/li>\n
    6. If you do not find any information, try the same the following day<\/li>\n
    7. If you have not found any information after 7 days, you should contact your system vendor by email and explicitly ask if the Log4J framework is used in your software.<\/li>\n<\/ol>\n<\/div>\n
      \n
      \n<\/div>\n<\/div>\n<\/div>
      <\/div>
      <\/div><\/div><\/div><\/div><\/div>
      <\/div>\n
      \n

      Here are some things you might want to check:<\/p>\n

      ERP System, CRM System, Banking Software, Time Recording Software, Accounting Payroll Software, Document Management Software, Telephony Software, Video Chat Software<\/p>\n<\/div>\n

      \n<\/div>\n<\/div>
      <\/div>
      <\/div><\/div><\/div><\/div><\/div>
      <\/i><\/div><\/div>

      On Wednesday the 15.12.2012 from 11:00-12:00
      Clock we give online information meeting on the current situation.<\/strong><\/span><\/p>\n

      When?<\/span>
      15.12.2021<\/span><\/p>\n

      Time:<\/span>
      11:00 – 12:00<\/span><\/p>\n

      Where?<\/span>
      Online<\/span><\/p>\n

      Everyone is welcome to participate. Just click on the button below on Wednesday at 11:00:<\/span><\/p>\n<\/div>

      Request participation link<\/span><\/a><\/div><\/div><\/div><\/div><\/div>
      <\/span><\/a><\/span>

      More information about Managed Firewall<\/p>\n<\/div><\/div><\/div>

      <\/span><\/a><\/span>

      More information about Endpoint Security<\/p>\n<\/div><\/div><\/div>

      <\/span><\/a><\/span>

      More information about Hornet Security<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":8952,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[398,399],"tags":[442,446,439,443,403,441,438,448,444,440,447,445],"class_list":["post-10983","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-news","tag-cybersecurity-en","tag-exploit-en","tag-hacker-en","tag-hardware-en","tag-it-en","tag-log4j-en","tag-malware-en","tag-security-gap","tag-software-en","tag-virus-en","tag-weak-point","tag-zero-day-exploit-en"],"yoast_head":"\nAttention: Federal Office warns about massive and dangerous IT security vulnerability "Log4j - CosH Information Technology<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cosh.de\/log4j-sicherheitswarnung\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Attention: Federal Office warns about massive and dangerous IT security vulnerability "Log4j - CosH Information Technology\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cosh.de\/log4j-sicherheitswarnung\/\" \/>\n<meta property=\"og:site_name\" content=\"CosH Information Technology\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-13T16:40:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-04-27T13:11:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1500\" \/>\n\t<meta property=\"og:image:height\" content=\"844\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Eduard Horn\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eduard Horn\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/\"},\"author\":{\"name\":\"Eduard Horn\",\"@id\":\"https:\\\/\\\/cosh.de\\\/#\\\/schema\\\/person\\\/6e32ebc456f989dcd4a66259115b0570\"},\"headline\":\"Attention: Federal Office warns about massive and dangerous IT security vulnerability “Log4j\",\"datePublished\":\"2021-12-13T16:40:03+00:00\",\"dateModified\":\"2022-04-27T13:11:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/\"},\"wordCount\":3469,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cosh.de\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg\",\"keywords\":[\"cybersecurity\",\"exploit\",\"Hacker\",\"hardware\",\"IT\",\"Log4J\",\"Malware\",\"security gap\",\"software\",\"Virus\",\"weak point\",\"zero day exploit\"],\"articleSection\":[\"Blog posts\",\"News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/\",\"url\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/\",\"name\":\"Attention: Federal Office warns about massive and dangerous IT security vulnerability \\\"Log4j - CosH Information Technology\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cosh.de\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg\",\"datePublished\":\"2021-12-13T16:40:03+00:00\",\"dateModified\":\"2022-04-27T13:11:48+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/#\\\/schema\\\/person\\\/6e32ebc456f989dcd4a66259115b0570\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cosh.de\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg\",\"contentUrl\":\"https:\\\/\\\/cosh.de\\\/wp-content\\\/uploads\\\/2021\\\/12\\\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg\",\"width\":1500,\"height\":844},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cosh.de\\\/log4j-sicherheitswarnung\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/cosh.de\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Attention: Federal Office warns about massive and dangerous IT security vulnerability „Log4j\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cosh.de\\\/#website\",\"url\":\"https:\\\/\\\/cosh.de\\\/\",\"name\":\"CosH Information Technology\",\"description\":\"IT-Dienstleister & Service Provider N\u00fcrnberg\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cosh.de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cosh.de\\\/#\\\/schema\\\/person\\\/6e32ebc456f989dcd4a66259115b0570\",\"name\":\"Eduard Horn\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g\",\"caption\":\"Eduard Horn\"},\"url\":\"https:\\\/\\\/cosh.de\\\/en\\\/author\\\/e-horn\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Attention: Federal Office warns about massive and dangerous IT security vulnerability \"Log4j - CosH Information Technology","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/","og_locale":"en_US","og_type":"article","og_title":"Attention: Federal Office warns about massive and dangerous IT security vulnerability \"Log4j - CosH Information Technology","og_url":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/","og_site_name":"CosH Information Technology","article_published_time":"2021-12-13T16:40:03+00:00","article_modified_time":"2022-04-27T13:11:48+00:00","og_image":[{"width":1500,"height":844,"url":"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg","type":"image\/jpeg"}],"author":"Eduard Horn","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Eduard Horn","Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#article","isPartOf":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/"},"author":{"name":"Eduard Horn","@id":"https:\/\/cosh.de\/#\/schema\/person\/6e32ebc456f989dcd4a66259115b0570"},"headline":"Attention: Federal Office warns about massive and dangerous IT security vulnerability “Log4j","datePublished":"2021-12-13T16:40:03+00:00","dateModified":"2022-04-27T13:11:48+00:00","mainEntityOfPage":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/"},"wordCount":3469,"commentCount":0,"image":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#primaryimage"},"thumbnailUrl":"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg","keywords":["cybersecurity","exploit","Hacker","hardware","IT","Log4J","Malware","security gap","software","Virus","weak point","zero day exploit"],"articleSection":["Blog posts","News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cosh.de\/log4j-sicherheitswarnung\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/","url":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/","name":"Attention: Federal Office warns about massive and dangerous IT security vulnerability \"Log4j - CosH Information Technology","isPartOf":{"@id":"https:\/\/cosh.de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#primaryimage"},"image":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#primaryimage"},"thumbnailUrl":"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg","datePublished":"2021-12-13T16:40:03+00:00","dateModified":"2022-04-27T13:11:48+00:00","author":{"@id":"https:\/\/cosh.de\/#\/schema\/person\/6e32ebc456f989dcd4a66259115b0570"},"breadcrumb":{"@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cosh.de\/log4j-sicherheitswarnung\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#primaryimage","url":"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg","contentUrl":"https:\/\/cosh.de\/wp-content\/uploads\/2021\/12\/hacker-attack-computer-hardware-microchip-while-process-data-through-internet-network-3d-rendering-insecure-cyber-security-exploit-database-breach-concept-virus-malware-unlock-warning-screen.jpg","width":1500,"height":844},{"@type":"BreadcrumbList","@id":"https:\/\/cosh.de\/log4j-sicherheitswarnung\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/cosh.de\/en\/"},{"@type":"ListItem","position":2,"name":"Attention: Federal Office warns about massive and dangerous IT security vulnerability „Log4j"}]},{"@type":"WebSite","@id":"https:\/\/cosh.de\/#website","url":"https:\/\/cosh.de\/","name":"CosH Information Technology","description":"IT-Dienstleister & Service Provider N\u00fcrnberg","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cosh.de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cosh.de\/#\/schema\/person\/6e32ebc456f989dcd4a66259115b0570","name":"Eduard Horn","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/11b52a467dc04519233801448d4b76f9a57e25ca0624c52c208f20c8c3aca609?s=96&d=mm&r=g","caption":"Eduard Horn"},"url":"https:\/\/cosh.de\/en\/author\/e-horn\/"}]}},"_links":{"self":[{"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/posts\/10983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/comments?post=10983"}],"version-history":[{"count":5,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/posts\/10983\/revisions"}],"predecessor-version":[{"id":10988,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/posts\/10983\/revisions\/10988"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/media\/8952"}],"wp:attachment":[{"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/media?parent=10983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/categories?post=10983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cosh.de\/en\/wp-json\/wp\/v2\/tags?post=10983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}