DHS Cyber Safety Review Board found no evidence China knew of Log4j before disclosure

The report suggests that even though risk still remains for unpatched organizations, a government-wide response helped drive mediation.

The Department of Homeland Security’s inaugural Cyber Safety Review board released its first-ever report Thursday, issuing a set of 19 recommendations in response to the widespread Log4j vulnerability that continues to affect networks around the world.

“Log4j is one of the most serious software vulnerabilities in history,” Rob Silvers, DHS undersecretary for strategy, policy and plans, said in a call with reporters Wednesday, echoing warnings from intelligence officials about the severity of the vulnerability when it was discovered last December.

The bug, disclosed initially by Chinese Alibaba researchers, led to the widespread exploitation of systems using the Apache Software Foundation’s open-source logging tool.

As part of the review, the CSRB engaged with 80 organizations and individuals including the Chinese government. The board brought in Chinese officials to discuss reports that the Chinese government had punished Alibaba for not disclosing the vulnerability quickly enough.

Chinese officials confirmed that Alibaba shared the vulnerability with the Chinese government on Dec. 13, three days after CISA issued an advisory in response to observations of the vulnerability in the wild. Chinese officials did not say if the government had punished the company in any way.

“This lack of transparency heightened the board’s concern that China’s regulatory regime will discourage network defenders from engaging in beneficial vulnerability disclosure activity with software developers,” Silvers told reporters.

In its review, the board raised further concerns about two Chinese regulations that could potentially threaten U.S. cybersecurity, one which requires Chinese companies to report vulnerabilities to the government within two days of discovery and a second that prohibits organizations or individuals from publicly disclosing vulnerabilities during loosely defined “major national events.”

However, there’s no indication that those regulations facilitated any early exploits of the Log4j vulnerability. Silvers said that the board found no evidence the vulnerability had been exploited prior to public disclosure.

The DHS assembled the Cyber Safety Review Board, which was outlined in Biden’s May 2021 executive order on federal cybersecurity, in February. Silver chairs the board that includes 15 members from the private and public sector.

The report suggests that even though Log4j remains a risk, a government-wide response helped drive remediation of the vulnerability. For instance, the report notes “anecdotal” evidence that some organizations addressed the vulnerability after the Federal Trade Commission warned of potential enforcement actions.

The board also identified the need for additional funding to support the mostly volunteer open source software security community.

The White House has already launched some public-private collaborations on that front, including a summit in January where companies including Apple and Google met with the White House to discuss proposals to improve open source software security.

Recommendations for the federal government from the report include directing the Office of Management and Budget to invest in new technology tools to help more accurate inventories of software.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure