FTC to Companies: Patch Log4j ASAP or Suffer Our Wrath

The Federal Trade Commission has a message for corporations that aren’t taking the risk posed by log4j to coronary heart: Patch up or lawyer up. Consider yourselves warned.

By now, you’ve absolutely heard of the aforementioned bug: It’s a giant, horrible safety vulnerability (CVE-2021-44228) at the moment troubling giant swaths of the web (there are literally multiple vulnerabilities which have been found however the preliminary one is what’s inflicting a lot of the hassle). Indeed, since its discovery in early December, log4j has pressured droves of the online’s largest corporations to scramble and patch their merchandise and methods earlier than felony hackers can get at them. On Tuesday, the FTC issued a stern warning to corporations that is probably not totally prioritizing this entire course of.

“ It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action,” the company mentioned, in a statement, noting that the related bugs at the moment pose “severe risk to millions of consumer products to enterprise software and web applications.” The FTC added that it’ll “use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future.”

The FTC has the facility to sue corporations for sub-standard safety practices that endanger buyer information. (A U.S. Appeals Court ruling in 2015 decided as much.) This isn’t the primary time the FTC has taken motion in opposition to corporations for not doing sufficient to guard folks’s information. In 2017, for instance, the FTC sued the Taiwanese IoT {hardware} supplier D-Link and its American subsidiary over its misrepresentation of the safety of its good dwelling merchandise. The company additionally helped secure a $7o0 million settlement from Equifax in 2019 after the crediting firm infamously suffered a cataclysmic information breach.

The new FTC announcement may sound somewhat aggressive, but it surely’s undoubtedly wise; the log4j vulnerability has already led to an immense quantity of hassle, together with a cascade of malicious activity and numerous high-profile hacking incidents. The bug, which exists in a free, open-source logging library put out by Apache, is utilized by a majority of the main platforms upon which most Americans rely. (Think manufacturers like Amazon, Apple, Cloudflare, Twitter, LinkedIn, and so forth.)

To give companies some useful sources fairly than simply authorized threats, the FTC additionally offered a hyperlink to the newest Apache software program bundle replace in its announcement, in addition to steerage from the Cybersecurity and Infrastructure Security Agency on easy methods to mitigate the vulnerability. If you’re , you possibly can test all that out here. And should you’re an organization, simply patch it up already.