FTC to US Companies: Patch Log4J Flaw or Face Legal Action

In issuing the warning, the FTC cites the huge settlement Equifax paid for a 2017 data breach involving a known vulnerability it failed to patch.

By Michael Kan

The risk of the Apache Log4j bug leading to a major data breach has prompted the Federal Trade Commission to demand that US companies patch the flaw or face a potential lawsuit.

The FTC warning cites the growing number of hackers already targeting the flaw. “It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action,” the regulator wrote.

It’s rare for the commission to issue a legal threat over a software vulnerability. But in issuing its demand, the FTC points to the $650 million settlement it reached with credit bureau Equifax for a 2017 data breach involving the data of over 143 million US consumers. That breach was orchestrated using a two-month-old software flaw that Equifax had failed to patch, even though it was already known that hackers were exploiting the vulnerability.

The FTC is now hoping to avoid a repeat. The Log4J vulnerability is raising alarm bells because the Apache software is used across countless web and IT products as a tool to log changes. The flaw is also trivial to exploit, making it easy for hackers to spread malware on a vulnerable system, such as a company server.

However, the problem mainly affects enterprises and government agencies, not regular consumers, so it’s up to companies to act before hackers use the flaw to attack their systems.

“The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future,” the agency says.

The FTC adds that it’s also scrutinizing how the IT industry relies on many open-source projects, such as Apache Log4J, to help run and maintain their software. The problem is that the same open-source projects are “often created and maintained by volunteers, who don’t always have adequate resources and personnel for incident response and proactive maintenance,” it says.

“This overall dynamic is something the FTC will consider as we work to address the root issues that endanger user security,” it adds.

Originally published at https://www.pcmag.com.