Pierluigi Paganini
January 05, 2022
The US Federal Trade Commission (FTC) warns legal action against companies who protect their systems against Log4Shell (CVE-2021-44228) attacks.
The move aims at urging organizations in protecting their infrastructure while both nation-state actors and cybercriminals are exploiting Log4J flaws in their campaigns.
“When vulnerabilities are discovered and exploited, it risks a loss or breach of personal information, financial loss, and other irreversible harms. The duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act. It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action.” reads the announcement published by the US FTC.
“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future. ”
The US Agency urges organizations to conduct an assessment of their infrastructure checking for Log4J vulnerabilities, it also recommends consulting the Cybersecurity and Infrastructure Security Agency (CISA)’s Apache Log4j Vulnerability Guidance.
FTC also recommends:
Recently CISA issued an emergency directive that ordered US Federal Civilian Executive Branch agencies to patch the Log4Shell bug until December 23. The deadline to report systems impacted by the Log4Shell flaw was postponed to December 28.
CISA set up a page dedicated to Log4Shell vulnerabilities and released a Log4j scanner to identify web services affected by Apache Log4j flaws
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Log4Shell)
[adrotate banner=”5″]
[adrotate banner=”13″]
