Log4Shell 2021: the hidden software component that alarmed the world

Nabayn did not work on this incident. This is our analysis of what is on the public record, written so other organisations can learn from it.

In December 2021, security teams everywhere were asking the same question: do we use Log4j? Many had never heard of it, and many could not easily find out. The panic was not only about the flaw itself. It showed that most organisations do not really know what is inside their own software.

What happened

Log4j is an open-source logging library, a building block used by apps and services across the internet to do the common job of keeping logs. In December 2021, a critical vulnerability known as Log4Shell was found in it. If left unfixed, attackers could break into systems, steal passwords and logins, extract data and infect networks with malicious software.¹

The UK’s National Cyber Security Centre said Log4j was used worldwide, and that the vulnerability required very little expertise to exploit. It described Log4Shell as potentially the most severe computer vulnerability in years.¹

The GitHub Advisory Database records it as a remote code injection flaw, under the reference CVE-2021-44228.² The Apache Logging project, which maintains the tool, publishes security information for its projects.³

Why it was so hard to deal with

Modern software is rarely written from scratch. As the NCSC explained, it is increasingly made of “building blocks” pulled together by a team, and Log4j was one of them.¹ A product you buy may include a component which includes another component which includes Log4j. So the NCSC warned that it might not be immediately clear to organisations that their web servers, applications, network devices and other software and hardware used it.¹

That is the real lesson of this incident. You could not simply check whether you had “installed Log4j”, because you may never have knowingly done so.

The NCSC’s advice for organisations included checking systems for the use of Log4j, keeping affected products updated to the latest version, and asking in-house developers and third-party suppliers. It also asked developers of affected software to communicate promptly with their customers.¹ For individuals, the best protection was keeping devices and apps up to date.¹

What a small business can learn

You are unlikely to be running servers yourself, but you do depend on people who are. These are our suggestions.

Keep a list of what you use. This should include your website, plugins, apps, online services, and who looks after each one. When the next incident hits the news, this list tells you who to ask.

Know who is responsible for updates. For each item, write down who applies the fixes: you, your host, or your developer. Many website owners assume someone else is doing it.

Ask your suppliers. When a major flaw is in the news, a short email can settle it: “Are you affected by this, and what have you done about it?” A good supplier will be able to answer quickly. The answer will also tell you a lot about that supplier.

Make sure your website is maintained. A website built five years ago and never touched since will contain old building blocks. If nobody is updating it, plan to fix that.

Keep your own devices updated. That was the NCSC’s main advice to individuals, and it applies to every phone and laptop in your business.

If you commission or build software

Ask your developer these questions:

• Can you give me a list of the third-party components in my software?
• How do you find out about a flaw in one of them?
• How quickly could you fix it, and who would pay for that?

We use automated audits of our dependencies, and we keep an inventory for each release, so we can answer these questions for the software we build. Care plans exist for exactly this reason, because software needs looking after long after launch.

Log4Shell did not come from carelessness in the usual sense. It came from a world in which everyone relies on shared parts. For related risks, read our analyses of SolarWinds and CrowdStrike. If you are deciding what to commission, see build or buy.