Belgian defence ministry admits attackers accessed its computer network by exploiting Log4j vulnerability
- Reference: 1640089993
- News link: https://www.theregister.co.uk/2021/12/21/belgium_defence_ministry_log4j_exploited/
- Source link:
The attack took place last week, [1]as reported by Flemish-language TV news station VRT, which said "some of the ministry's activities were paralysed for several days."
Belgian MoD spokesman Olivier Severin said in a prepared statement seen by The Register : "Defence discovered an attack on its computer network with internet access on Thursday. Quarantine measures were quickly taken to isolate the affected parts. The priority is to keep the defence network operational."
[2]
He added: "This attack follows the exploitation of the Log4j vulnerability, which was made public last week and for which IT specialists around the world are jumping into the breach."
[3]
[4]
Log4j is a FOSS logging utility distributed by the Apache Foundation and bundled with Apache Server – making it extremely widely used. Its latest version, 2.17, is the third update in 10 days after the original discovery of [5]an actively exploited remote code execution vulnerability a fortnight ago. Since then more vulns have emerged, requiring quick-fire updates from Log4j's maintainers.
[6]Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility
[7]Bad things come in threes: Apache reveals another Log4J bug
[8]CISA issues emergency directive to fix Log4j vulnerability
[9]Over Log4j? VMware has another critical flaw for you to patch
Further details were [10]reported by ZDNet.
While the infosec industry has been loudly warning of potential problems, a defence ministry getting pwned – albeit by an attacker who hasn't been publicly identified – is a stark reminder to the rest of us that this flaw needs patching ASAP.
Yesterday Belgium's Centre for Cyber Security, a government organisation, issued a press release saying: "Companies that use Apache Log4j software and have not yet taken action can expect major problems in the coming days and weeks."
[11]
Perhaps they were having a little fun at their uniformed colleagues' expense.
The US government's Cybersecurity and Infrastructure Security Agency (CISA) last week issued an emergency directive requiring federal agencies to take corrective action on Apache Log4j vulnerability by 1700 EST on December 23, 2021. Readers working for the Feds, we feel your pain.
NATO, whose European HQ is in the Belgian capital, did not respond when The Register asked if its networks had been affected. ®
Get our [12]Tech Resources
[1] https://www.vrt.be/vrtnws/nl/2021/12/20/defensie-slachtoffer-zware-cyberaanval-deel-netwerk-al-dagen-pl/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YcIIQzS4N8ugzs6@kv4hCgAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YcIIQzS4N8ugzs6@kv4hCgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YcIIQzS4N8ugzs6@kv4hCgAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[6] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[7] https://www.theregister.com/2021/12/19/log4j_new_flaw_cve_2021_45105/
[8] https://www.theregister.com/2021/12/17/cisa_issues_emergency_directive_to/
[9] https://www.theregister.com/2021/12/17/vmware_criticial_uem_flaw/
[10] https://www.zdnet.com/article/belgian-defense-ministry-confirms-cyberattack-through-log4j-exploitation/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YcIIQzS4N8ugzs6@kv4hCgAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
You are... right !!! Code runs on rockets, DHS computers, nuclear silos. All it takes is to find a vulnerability, and a way to exploit it.
But getting rid of malware would require rebuilding everything from scratch, from apps down to firmware, possibly the silicon too, using an entirely different model of how things are done.
Getting rid of malware is actually pretty simple. Instead of allowing any software to run, and then running software to scan for known viruses simply specify what *should* be running and block everything else. You can do that at the moment in about ten minutes even on Windows; (google software restriction policy or applocker policy; these are group policy objects available free of charge out of the box). That takes care of the windows endpoints; Linux ones will probably already be aware of SE Linux.
Then put access to your network behind a VPN secured with 2FA and then be paranoid with your incoming firewall rules. And splash £10 a month to host your website with a random web host instead of saving money and hosting it yourself; if it gets hacked then your able to just shrug and wipe and FTP the replacement back up with no further damage to yourself.
Hey presto, you have 95% of the benefits at 0% of the cost, and it's available now.
> simply specify what *should* be running
You're kidding? In those days when everybody and his dog demands to freely run his stuff on my computer/phone ("for my convenience" of course), and otherwise perfectly sane people think "web apps" are cool?
Seriously, I totally agree with you, and software restriction has saved my hide in the past, but it's so totally against the current zeitgeist that it becomes impossible, except on dedicated, single-task devices. Heck, nowadays people can't even prevent Windows from spying on them... As the most extreme example take the smartphone, where the user is just a powerless guest with no control whatsoever, only able to play with the colored buttons in his playpen.
Yes, yes, I'm running Linux, mostly for that reason, but it's no silver bullet either. Here too, regrettable drifts are slowly starting to surface over time.
This particular problem seems to be the result of creeping featurism. Eliminating that would be a good idea. Did someone say "Do one thing and do it well"?
So if "computer engineering is fundamentally broken" what's your solution, other than "do it different"?
I'm serious, we need all the help we can get.
I see it's a basic consequence of the fact that every time we write an application, we're mostly doing something completely new, that hasn't been done before, under tight time and resource constraints.
I've seen dozens of major coding methodologies in my life. Flowcharting everything. Gotos are bad. Structured programming. Top-down design. Functional programming, Object-oriented. Pair coding. Agile. Copying from stackoverflow.
People are (mostly) doing their best, but programming is hard and irreducible complexity is irreducible.
From personal experience of 24 years as a developer, a few things that might help:
Allow developers to choose the best languages and tools for the job, instead of mandating particular solutions just because they happen to be in vogue. Old doesn't mean bad.
Following on from above, don't constantly switch language with every change in the wind.
"Agile" is not the solution to every problem. If, as a business, you're going to "do agile", take the time to fully understand what it means - don't just read the Agile Manifesto, don't pay lip-service while resolutely resisting any actual change to development practices, and absolutely do not see it as a silver bullet that will magically solve all problems.
Give sufficient time to design and develop a proper solution without scope creep.
Listen to your devs when they say something won't work, is a poor choice etc. They usually know what they're talking about.
Test continuously, as a mandatory part of the development process, not just a tacked on afterthought that can be dismissed if it seems too expensive or clashes with a pre-ordained release shedule.
Let development be managed by people who actually know what they're doing, instead of MBA's that know jack shit about programming.
Of course, there's loads more depending on your personal experience.
It's much easier to build a plane using decade old technologies than making the web run safely, which relies on 7 technological layers, each one having its own vulnerabilities, several of them evolving constantly - and don't start with me about layer 8, the worse of them all.
The complexity of IT is several orders of magnitude the one of common devices, with maybe the exception of rockets, which explode from time to time. It's beyond human possibility to have a totally safe ecosystem, even if we go back to intel 4004 with I/O limited to keyboard and screen.
But this is fundamentally how humans advance. Almost everything is just an older idea better wrapped or used differently. If we had to reinvent everything every single time we'd never get anywhere.
[1]Worth looking at this documentary series.
True 'blue-sky' inventions are uncommon.
As computer systems get more and more complex we have to rely more and more on pre-existing solutions. It is not reasonable for me to have to re-invent a trace/logging system every time I start a new project. Whether it's truly new or I'm just joining an established team there is far too much value in me being able to say 'Oh yes, I know that package'. The cost of me having to learn a proprietary library or help develop it is unreasonable for most projects.
The answer is not to shy away from utilising external code. The answer is to learn how to do so safely.
[1] https://en.wikipedia.org/wiki/Connections_(British_documentary)
It's taken them seven years....and they decided the previous hack was on the wrong Belgians!!!
Link: https://theintercept.com/2014/12/13/belgacom-hack-gchq-inside-story/
XKCD puts this nicely: https://xkcd.com/2030/
The entire field of computer engineering is fundamentally broken. This kind of crap is going to keep happening, and in the future it might get anywhere from mildly better to horribly worse.
But getting rid of malware would require rebuilding everything from scratch, from apps down to firmware, possibly the silicon too, using an entirely different model of how things are done. Developing in such an environment would be a full order of magnitude more costly, and some features would be outright unfeasible. I don't see this happening.