The Numbers Behind Log4j Vulnerability CVE-2021-44228

Contact Us

For any questions or inquiries concerning the Log4j vulnerability please email
Log4j@Checkpoint.com

30 Days Free AppSec & Free Lifetime Protection Against Log4j Exploits

The Only Security Solution Which Pre-Emptively Prevented the Log4j Exploit!
GET IT NOW

Scan Now for Log4j Vulnerabilities

A fully automated and extensive scanner for finding vulnerable log4j public hosts
SCAN NOW

Precisely one year after the SolarWinds Hack, the groundbreaking supply chain attack the world experienced, and while organizations are still struggling to protect the software supply chain from third-party risk, the Apache Log4j vulnerability exploit has caught security teams during a weekend. Unlike other major cyber-attacks that involve one or a limited number of software, Log4j is basically embedded in every Java based product or web service. It is very difficult to manually remediate it. Once an exploration was published (on Friday), scans of the internet ensued (to allocate surfaces which are vulnerable due to this incident). Those who won’t implement a protection are probably already scanned by malicious actors.

Since Friday, December 9^th, when the vulnerability was reported, actors around the world are on the lookout for exploits. The number of combinations of how to exploit it give the attacker many alternatives to bypass newly introduced protections. It means that one layer of protection is not enough, and only multi-layered security posture would provide a resilient protection. Three days after the outbreak, we are summing up what we see until now, which is clearly a cyber pandemic that hasn’t seen its peak yet.

A True Cyber Pandemic

Diving into the numbers behind the attack, gathered and analyzed by Check Point Research, we see a pandemic-like spread since the outbreak on Friday, by the beginning of the week, on Monday.
Early reports on December 10^th showed merely thousands of attack attempts, rising to over 40,000 during Saturday, December 11^th. Twenty-four hours after the initial outbreak our sensors recorded almost 200,000 attempts of attack across the globe, leveraging this vulnerability. As of the time these lines are written, 72 hours post initial outbreak, the number hit over 800,000 attacks.

It is clearly one of the most serious vulnerabilities on the internet in recent years, and the potential for damage is incalculable.

Check Point Research witnessed new variations of the original exploit being introduced rapidly- over 60 in less than 24 hours.
When we discussed the Cyber pandemic, this is exactly what we meant – quickly spreading devastating attacks.

Corporate networks impacted globally

One of the most dramatic characteristics of a cyber pandemic are major vulnerabilities in popular software and services, which impact an enormous number of organizations across the globe, spreading like wild fire.

Since we started to implement our protection we prevented over 4,300,000 attempts to allocate the vulnerability, over 46% of those attempts were made by known malicious groups.
We have so far seen an attempted exploit of over 48% of corporate networks globally.

*Updated 20.12.2021 01:30 AM PST

This diagram use figures for the 13.12.2021

Corporate numbers impacted by countries

The spread per countries is overwhelming and crosses continent and regions, ranging to over 90 countries in all regions. The impact itself is also wide and reaches peaks of countries seeing over 60% of corporate networks impacted, and many distributions seeing over 50% of corporate networks within the country beings impacted.

*A detailed breakdown per countries included in Annex 1

On Tuesday (12/14/21), we showed how such an attempt resulted in real life attack of a crypto mining group on 5 countries.

Wednesday (12/15/21), we can report that a known Iranian hacking group (commonly associated with the local regime),named “Charming Kitten” or APT 35, is also behind an attempt to exploit the Log4j vulnerability against 7 targets in Israel (from the government and business sector) in the last 24 hours.

We have blocked these attacks, as we witnessed communications between a server used by this group and the targets in Israel.

The scope of this attack was between 6am -4pm PST (1600-0200 TLV time). There’s no evidence for the group’s related activity on targets outside of Israel.

We will continue to investigate attacks related to Log4j. Our reports of the last 48 hours prove that both criminal hacking groups and nation state actors are engaged in the exploration of this vulnerability, and we should all assume more such actors’ operation are to be revealed in the coming days.

The Brain behind Check Point’s threat prevention

The statistics and data used in this report present data detected by Check Point’s Threat Prevention technologies, stored and analyzed in ThreatCloud. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. ThreatCloud is actually the brain behind Check Point Software’s threat prevention power, combines big data threat intelligence with advanced AI technologies to provide accurate prevention to all Check Point Software customers.

Instant protections from the most significant unknown software vulnerabilities
All software vulnerabilities that are found by CPR or seen in the wild, such as Log4j, are immediately fed to ThreatCloud, which propagates the appropriate protections throughout Check Point’s products, so that all Check Point customers are instantly protected with no patching needed. That is exactly what happened last weekend. As soon as the Log4j vulnerability was reported on December 9, all relevant protections were propagated through all of Check Point products (refer to sk176884).

Conclusion

This vulnerability, because of the complexity in patching it and easiness to exploit, seems that it will stay with us for years to come, unless companies and services take immediate action to prevent the attacks on their products by implementing a protection.

Since the outbreak of the COVID-19 pandemic, society has already gotten used to learning about variants, spread and other terminology that is taken from epidemiology theories. The phenomena the world is witnessing with the exploitation of this vulnerability is very much identical.
Given the upcoming holiday seasons, when security teams may be slower to implement protective measure, the threat is imminent. This acts precisely like a cyber pandemic — highly contagious, spreads rapidly and has multiple variants, which force more ways to attack.

How can Check Point Help?

Check Point Infinity provides protection against the Log4j Vulnerability.

We invite you to visit our dedicated website to learn more about this vulnerability and how Check Point products ensure you stay protected

To help customers, we are providing informative and actionable resources based on our R&D teams’ experience, expertise and insights.

We will continue to update on any new development of this significant security event.
Our technical support teams are available for you 24/7 and we are all at your service to make sure you’ll stay protected.

Annex 1 – Detailed breakdown – Impact per country