Six Months Later: Assessing the OT and ICS Risks of the Log4j Vulnerability
Summary: Six months after the Log4j flaw (CVE-2021-44228) was disclosed by Alibaba Cloud Security, Dragos assesses with moderate confidence that it will remain a persistent vulnerability in ICS environments for years, since Log4j is often an embedded component of Java-based ICS hardware and software that leaves operators dependent on vendors for patches. Google's Open-Source Insights found 17.84K affected packages with only 7.14K patched, and Rezilion found over 90,000 vulnerable internet-facing applications and more than 68,000 servers still publicly exposed as of April 2022.
Key Takeaway: Nation-state actors are already using it: Symantec attributed an attack on an undisclosed energy and military engineering firm to Stonefly, which compromised at least 18 computers, and Dragos reported adversaries compromising PingFederate SSO devices at industrial organizations in energy, manufacturing, and pharmaceutical sectors.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2021-44228
- Related
- CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021