Cyber flaw within CRA, Quebec also prevalent in private sector, experts warn
Global News
Experts describe the software flaw as``leaving the back door open'' in that it could give cyber criminals access to the thousands of organizations that use the logging library.
Experts say Canadians should use good “cyber hygiene” in light of the discovery of a massive software flaw that has resulted in the precautionary shutdown of thousands of websites.
The federal government, the government of Quebec and the Canada Revenue Agency are among the organizations that temporarily suspended websites as a precaution after the Canadian Centre for Cyber Security issued an alert Dec. 10 about the recently discovered software vulnerability in a Java-based library of an Apache product known as Log4j.
Experts describe the software flaw as akin to “leaving the back door open” in that it could give cyber criminals access to the thousands of organizations that use the open-source logging library.
“What we’re talking about here isn’t an attack or a hack or malware. What we’re talking about is a door that’s been left open and can be exploited,” said Brent Arnold, a Toronto-based litigator and data breach coach with the law firm Gowling WLG. “We know already that people are out there trying to take advantage of this.”
Arnold said hackers are able to use the software flaw to breach an organization’s defences, meaning they could potentially take control of its web servers, introduce malware or ransomware attacks, or steal customer data.
While public and government institutions appear to be the ones making public statements about Log4j so far, cybersecurity experts say the logging library is widely used in the private sector as well.
Patrick Mathieu, the co-founder of Hackfest, a large computer security event in Quebec City, said he’s concerned about the lack of communication from companies like major banks about how they’re working on the problem.
“Yes, the (Quebec) government shut this down, but what about big institutions, finance, insurance, mortgage, medical companies? Are they working on the issue?” Mathieu said.
