Security experts are sounding the alarm over a newly discovered software vulnerability, and organisations have been advised to “urgently” check whether it leaves them exposed to hackers.

Alerts have been issued by the British and American governments as a growing number of hacking groups – potentially including spies and organised criminals – are exploiting the vulnerability to break into computer networks.

The British government said it was treating “this issue with the utmost seriousness” as the US warned the vulnerability was “being widely exploited by a growing set of threat actors”.

Researchers in the private sector said “the potential for damage is incalculable” with one describing the severity as: “The internet is on fire right now.”

What is the issue?

It is very rare for enterprise software to be completely written from the ground up for every different product.

Instead this software often depends on a shared library of open-source code maintained by charity organisations and distributed without any royalties.

GCHQ sends out brainteaser Christmas card – can you solve the festive puzzles?

Watchdog calls for scrutiny after ex-GCHQ director accused of revealing spy work in Jihadi John documentary

Abdul Elahi: Predator who blackmailed 2,000 victims and sold ‘box sets’ to paedophiles jailed for 32 years

The new vulnerability has been discovered in one such bit of code.

Known as Log4j, the open-source tool is an Apache Software Foundation project and used almost ubiquitously in enterprise software products and cloud services.

It won’t directly impact people using personal devices, but any data they have with organisations that operate web servers could be at risk.

A fix has already been published by Apache – which described the vulnerability as “critical” – and large companies who control and update their own software should be able to quickly patch the vulnerability.

But because Log4j is so widely used as a logging utility there are likely to be thousands of companies exposed because the flaw affects third-party software which they cannot directly update.

Apache credited Chen Zhaojun, a security researcher at Chinese company Alibaba, for discovering and reporting the issue.

Who has been affected?

The first wave of victims were people playing the Microsoft-owned computer game Minecraft.

Hackers were able to post a short message in the Minecraft chatbox to remotely execute commands on the computers of other players.

Microsoft said it has patched the issue for Minecraft players and told customers they would be protected if they applied the fix.

The most obvious first wave of attacks all involved “cryptojacking”, when hackers hijack victim’s computers to use their processing power to mine cryptocurrencies.

Microsoft warned that alongside installing coin miners it had seen hackers exploiting the flaw to steal credentials and data from victim’s computers.

“The internet’s on fire right now. People are scrambling to patch and all kinds of people are scrambling to exploit it,” said Adam Meyers, senior vice president of intelligence at cyber security company Crowdstrike.

‘A very serious threat’

“I cannot overstate the seriousness of this threat,” warned Lotem Finkelstein, director of threat intelligence for Check Point Software Technologies.

Mr Finkelstein warned that the cryptojacking activity “creates just the sort of background noise that serious threat actors will try to exploit in order to attack a whole range of high value targets”.

Check Point has detected hundreds of thousands of attempts to exploit this vulnerability across more than a third of all corporate global networks.

“Security teams need to jump on this with utmost urgency as the potential for damage is incalculable,” Mr Finkelstein added.

Related posts:

New vaccine has in-built ‘insurance’ against coronavirus mutations Microsoft warns multiple groups hacking clients’ email servers China and Russia to build joint moon base 5G spectrum goes up for auction as rollout continues Scientists solve mystery of supergiant star Betelgeuse’s ‘great dimming’ Elon Musk says he ‘rather hates’ being CEO of Tesla Sophisticated malware is being used to spy on journalists, politicians and human rights activists Hackers could have stolen beer from BrewDog using bug that exposed details of 200,000 shareholders Apple shares tumble as iPhone 13 production reportedly slashed Microsoft to shut down LinkedIn in China after being criticised for censoring Western journalists Facebook’s Meta to ban adverts that target people on ‘sensitive topics’ politics, race and sexual orientation Dogs can video call owners with new invention which could tackle anxiety in home alone pets