(Hong Kong, 16 December 2021) The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) of the Hong Kong Productivity Council is urging local IT users to patch their systems as soon as possible in light of the discovery of a critical vulnerability in Apache “Log4j” and an upsurge in related exploit attempts globally.

Apache “Log4j” is an open-source logging application commonly used in a wide range of IT equipment and software products, such as web servers, network devices, database servers, etc. For the current issue, systems running Apache Log4j version 2.14.1 or below are most vulnerable. Attackers can exploit the vulnerability to seize control of the system and turn it into part of a botnet with updated version of Mirai and Mushtik malware, or even launch ransomware attacks such as Khonsari. As HKCERT believes the situation will continue to worsen with more new malware and ransomware attacks related to the “Log4j” vulnerability on the horizon, it urges both individuals and organisations to pay extra attention to related attacks and promptly apply security patch.

Affected product vendors have been releasing security patches. Local IT users should promptly download and install the relevant security patch from the official website as soon as possible. For patch details of individual products, users can contact the product vendors. For more details about “Log4j” vulnerability’s affected products, mitigations, detection methods, and protection measures, please refer to the following URL:

https://www.hkcert.org/security-bulletin/java-se-remote-code-execution-vulnerability_20211210

Should users have further questions, please do not hesitate to contact HKCERT via email: hkcert@hkert.org or its 24-hour telephone hotline: 8105 6060. HKCERT will continue monitoring the latest development of the attacks and keep the public informed if there are any updates.