Google Cloud offers good news and bad news on Log4Shell, other issues

Potential intruders are still scanning for the bug every day, but the company says many vendors have been on top of fixing vulnerable instances of Log4j software.

Google Cloud is seeing 400,000 scans per day for systems vulnerable to the Log4Shell bug, the company said Tuesday.

The findings — released as part of the company’s semi-regular Threat Horizons report — show that IT security professionals need to “keep paying attention to this, because the scans keep coming, and if you leave one vulnerable instance open, you’re going to be found,” Phil Venables, the chief information security officer at Google Cloud, told CyberScoop.

That said, the companies interacting with Google Cloud have “been very much on top of this,” according to Venables. The warning comes as a reminder, however, to security professionals to keep doing the work of finding the devices and software vulnerable to the Log4Shell bug, which affects versions of the widely used Log4j logging software that haven’t been patched since early December.

Shane Huntley, the head of Google’s Threat Analysis Group, said that the daily scan numbers are not a direct measure of the threat. Rather, “it is now just background that if you are vulnerable to this on the internet you could be compromised,” he said. “You need to be aware that this is going on full time.”

Google Cloud’s data suggests that scans daily scans may have peaked in the weeks following Log4j’s discovery above the 400,000 per day figure, but some of that reflected security researchers and others trying to figure it out, Huntley said. But now, the problem could be worse in some ways because “people are doing this for real in a systematic way versus some of the early scanning.” Either way, “this will be a background threat to the internet now like other vulnerabilities have been.”

The data comes as part of the second Threat Horizons report, which was first published in November. It’s meant as a periodic briefing for CISOs and others in the information security space to get insights into threats Google Cloud and other security teams within the software giant are seeing.

A North Korean threat

The report also touches on an internet domain identified in March 2021 by Google’s Threat Analysis Group as being part of a North Korean campaign to target individual security researchers. It was flagged in November 2021 by security firm ESET as being used to distribute trojanized software. Over the last year and more, Google notes in the new report, the North Korean hackers launched “multiple campaigns” against the security and vulnerability research community as part of this effort.

The information was highlighted in the Threat Horizons report because CISOs and others should know that their researchers “are facing potentially these sorts of risks,” Huntley told CyberScoop. “It’s ongoing activity, but it sort of comes and goes in waves as they get called out.”

One of the security researchers targeted as part of the North Korea claims to have recently taken down North Korea’s internet for a short period, Wired reported Feb. 2.

Other items in the report include growing attacks using Sliver, an open-source alternative to the famous Cobalt Strike, which is designed to emulate how adversaries attack a network, but also can be used by malware actors. The built-in tools and abilities prized by industry “red teams” also make the software desirable for malicious attackers.

Similarly, the Google Cloud report details how attackers have been observed abusing the “Cloud Shell” feature of the company’s services to serve as a means for attackers to use the platform for other attacks.

“This is a growing element within the attacks customers are seeing,” Venables said, noting that only a “very small percentage” of Google Cloud customers are seeing this activity when they don’t maintain sufficient security.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems