You better have patched those Log4j holes or we'll see what a judge has to say – FTC

Apply fixes responsibly in a timely manner or face the wrath of Lina Khan


The US Federal Trade Commission on Tuesday warned companies that vulnerable Log4j software needs to be patched … or else.

In case any system administrators last month somehow missed the widespread alarm over vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832) in the Java logging package, the trade watchdog said Log4j continues to be exploited by a growing number of attackers and urged organizations to act now before it's too late.

The FTC is advising companies to consult the US Cybersecurity and Infrastructure Security Agency's (CISA) guidance on dealing with the Log4j flaws. If companies fail to fix their code and lose customer data, the FTC says it may just see what a judge thinks about that.

"The duty to take reasonable steps to mitigate known software vulnerabilities implicates laws including, among others, the Federal Trade Commission Act and the Gramm Leach Bliley Act," the commission said. "It is critical that companies and their vendors relying on Log4j act now, in order to reduce the likelihood of harm to consumers, and to avoid FTC legal action."

The commission pointed to the example it had made – with the help of the Consumer Financial Protection Bureau and 50 US states and territories – of hacked credit reporting firm Equifax, which agreed to pay $700m to settle charges that it exposed the personal information of 147 million people in 2017. In that instance it was a vulnerability in another open source project that permitted the data heist: Apache Struts.

The tribulations of Equifax may not be the threat the FTC thinks it is, given the skepticism about the commission's effectiveness. Privacy advocacy groups like EPIC note that not much has changed for the data gathering industry in recent years.

Europe's beating the US on data protection

In 2018, the Consumer Financial Protection Bureau, under Acting Director Mick Mulvaney, appears to have wrapped up its investigation of Equifax without seeking subpoenas or obtaining testimony from Equifax executives, or testing Equifax's security [PDF]. So much for oversight.

In testimony before the the House Committee on Financial Services on February 14, 2018, EPIC executive director Marc Rotenberg lamented the lack of a comprehensive US data protection regime like Europe's GDPR and noted the FTC's limited ability to protect data under the "Safeguards Rule" of the Gramm-Leach-Bliley Act.

In short, advocacy groups appear to believe the trade watchdog's bark is worse than its bite.

The Open Markets Institute, a progressive think tank, went so far as to denounce the FTC's 2019 $5bn privacy violation settlement with Facebook – now living under the assumed name Meta – as ineffective and woefully insufficient.

”If we had a strong privacy law on the books, Mark Zuckerberg would already be in jail for his serial lying about Facebook’s abuse of Americans’ data," said Senator Ron Wyden (D-OR) on Tuesday.

"Congress has the opportunity to act now by passing a comprehensive privacy law that can cut off the flow of data to Facebook’s outrage machine by setting strong new rules for how companies can collect, share and use Americans’ personal information. That will go right to Facebook’s business model and hit its bottom line, which seems to be the only thing that company cares about.”

In May last year, after seeing its authority curbed by the US Supreme Court, the FTC begged lawmakers restore its ability to recover funds from fraudsters.

The appointment of Columbia Law School professor and tech company critic Lina Khan last year as Chair of the FTC has raised hopes that the commission can become more effective in policing irresponsible or unlawful behavior among corporate giants, particularly in the tech industry. Khan's influential 2017 paper Amazon’s Antitrust Paradox was a deep dive into how the existing outdated anti-trust laws greatly benefited the tech giants.

The commission at least offers this commitment:

"The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future."

You have been politely cautioned. ®


Other stories you might like

  • How ICE became a $2.8b domestic surveillance agency
    Your US tax dollars at work

    The US Immigration and Customs Enforcement (ICE) agency has spent about $2.8 billion over the past 14 years on a massive surveillance "dragnet" that uses big data and facial-recognition technology to secretly spy on most Americans, according to a report from Georgetown Law's Center on Privacy and Technology.

    The research took two years and included "hundreds" of Freedom of Information Act requests, along with reviews of ICE's contracting and procurement records. It details how ICE surveillance spending jumped from about $71 million annually in 2008 to about $388 million per year as of 2021. The network it has purchased with this $2.8 billion means that "ICE now operates as a domestic surveillance agency" and its methods cross "legal and ethical lines," the report concludes.

    ICE did not respond to The Register's request for comment.

    Continue reading
  • Fully automated AI networks less than 5 years away, reckons Juniper CEO
    You robot kids, get off my LAN

    AI will completely automate the network within five years, Juniper CEO Rami Rahim boasted during the company’s Global Summit this week.

    “I truly believe that just as there is this need today for a self-driving automobile, the future is around a self-driving network where humans literally have to do nothing,” he said. “It's probably weird for people to hear the CEO of a networking company say that… but that's exactly what we should be wishing for.”

    Rahim believes AI-driven automation is the latest phase in computer networking’s evolution, which began with the rise of TCP/IP and the internet, was accelerated by faster and more efficient silicon, and then made manageable by advances in software.

    Continue reading
  • Pictured: Sagittarius A*, the supermassive black hole at the center of the Milky Way
    We speak to scientists involved in historic first snap – and no, this isn't the M87*

    Astronomers have captured a clear image of the gigantic supermassive black hole at the center of our galaxy for the first time.

    Sagittarius A*, or Sgr A* for short, is 27,000 light-years from Earth. Scientists knew for a while there was a mysterious object in the constellation of Sagittarius emitting strong radio waves, though it wasn't really discovered until the 1970s. Although astronomers managed to characterize some of the object's properties, experts weren't quite sure what exactly they were looking at.

    Years later, in 2020, the Nobel Prize in physics was awarded to a pair of scientists, who mathematically proved the object must be a supermassive black hole. Now, their work has been experimentally verified in the form of the first-ever snap of Sgr A*, captured by more than 300 researchers working across 80 institutions in the Event Horizon Telescope Collaboration. 

    Continue reading
  • Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...
    We take a look at low, low subscription prices – not that we want to give anyone any ideas

    A Tor-hidden website dubbed the Eternity Project is offering a toolkit of malware, including ransomware, worms, and – coming soon – distributed denial-of-service programs, at low prices.

    According to researchers at cyber-intelligence outfit Cyble, the Eternity site's operators also have a channel on Telegram, where they provide videos detailing features and functions of the Windows malware. Once bought, it's up to the buyer how victims' computers are infected; we'll leave that to your imagination.

    The Telegram channel has about 500 subscribers, Team Cyble documented this week. Once someone decides to purchase of one or more of Eternity's malware components, they have the option to customize the final binary executable for whatever crimes they want to commit.

    Continue reading
  • Ukrainian crook jailed in US for selling thousands of stolen login credentials
    Touting info on 6,700 compromised systems will get you four years behind bars

    A Ukrainian man has been sentenced to four years in a US federal prison for selling on a dark-web marketplace stolen login credentials for more than 6,700 compromised servers.

    Glib Oleksandr Ivanov-Tolpintsev, 28, was arrested by Polish authorities in Korczowa, Poland, on October 3, 2020, and extradited to America. He pleaded guilty on February 22, and was sentenced on Thursday in a Florida federal district court. The court also ordered Ivanov-Tolpintsev, of Chernivtsi, Ukraine, to forfeit his ill-gotten gains of $82,648 from the credential theft scheme.

    The prosecution's documents [PDF] detail an unnamed, dark-web marketplace on which usernames and passwords along with personal data, including more than 330,000 dates of birth and social security numbers belonging to US residents, were bought and sold illegally.

    Continue reading

Biting the hand that feeds IT © 1998–2022