A critical vulnerability in a widely used software tool — one quickly exploited in the online game Minecraft — is rapidly emerging as a major threat to organizations around the world.
“The Internet’s on fire right now,” said Adam Meyers, senior vice president of intelligence at the cybersecurity firm Crowdstrike.
“People are scrambling to patch,” he said, “and all kinds of people scrambling to exploit it.” He said on Friday that in the 12 hours since the bug’s existence was disclosed that it had been “fully weaponized,” meaning malefactors had developed and distributed tools to exploit it.
The flaw may be the worst computer vulnerability discovered in years.
It was uncovered in an open-source logging tool that is ubiquitous in cloud servers and enterprise software used across industry and government. Unless it is fixed, it grants criminals, spies and programming novices alike easy access to internal networks where they can loot valuable data, plant malware, erase crucial information and much more.
“I’d be hard-pressed to think of a company that’s not at risk,” said Joe Sullivan, chief security officer for Cloudflare, whose online infrastructure protects websites from malicious actors. Untold millions of servers have it installed, and experts said the fallout would not be known for several days.
Amit Yoran, CEO of the cybersecurity firm Tenable, called it “the single biggest, most critical vulnerability of the last decade” — and possibly the biggest in the history of modern computing.
The vulnerability, dubbed ‘Log4Shell,’ was rated 10 on a scale of one to 10 the Apache Software Foundation, which oversees development of the software. Anyone with the exploit can obtain full access to an unpatched computer that uses the software,
Experts said the extreme ease with which the vulnerability lets an attacker access a web server — no password required — is what makes it so dangerous.
New Zealand’s computer emergency response team was among the first to report that the flaw was being “actively exploited in the wild” just hours after it was publicly reported on Thursday and a patch released.
The vulnerability, located in open-source Apache software used to run websites and other web services, was reported to the foundation on Nov. 24 by the Chinese tech giant Alibaba, it said. It took two weeks to develop and release a fix.
But patching systems around the world could be a complicated task. While most organizations and cloud providers such as Amazon should be able to update their web servers easily, the same Apache software is also often embedded in third-party programs, which often can only be updated by their owners.
Mr Yoran, of Tenable, said organizations need to presume they’ve been compromised and act quickly.
The first obvious signs of the flaw’s exploitation appeared in Minecraft, an online game hugely popular with kids and owned by Microsoft. Mr Meyers and security expert Marcus Hutchins said Minecraft users were already using it to execute programs on the computers of other users by pasting a short message in a chat box.
Microsoft said it had issued a software update for Minecraft users.
“Customers who apply the fix are protected,” it said.
Researchers reported finding evidence the vulnerability could be exploited in servers run by companies such as Apple, Amazon, Twitter and Cloudflare.
Mr Sullivan of Cloudflare said there we no indication his company’s servers had been compromised.
Key findings of Jenkins report
- Founder of the Muslim Brotherhood, Hassan al Banna, "accepted the political utility of violence"
- Views of key Muslim Brotherhood ideologue, Sayyid Qutb, have “consistently been understood” as permitting “the use of extreme violence in the pursuit of the perfect Islamic society” and “never been institutionally disowned” by the movement.
- Muslim Brotherhood at all levels has repeatedly defended Hamas attacks against Israel, including the use of suicide bombers and the killing of civilians.
- Laying out the report in the House of Commons, David Cameron told MPs: "The main findings of the review support the conclusion that membership of, association with, or influence by the Muslim Brotherhood should be considered as a possible indicator of extremism."
Lexus LX700h specs
Engine: 3.4-litre twin-turbo V6 plus supplementary electric motor
Power: 464hp at 5,200rpm
Torque: 790Nm from 2,000-3,600rpm
Transmission: 10-speed auto
Fuel consumption: 11.7L/100km
On sale: Now
Price: From Dh590,000
Illegal%20shipments%20intercepted%20in%20Gulf%20region
%3Cp%3EThe%20Royal%20Navy%20raid%20is%20the%20latest%20in%20a%20series%20of%20successful%20interceptions%20of%20drugs%20and%20arms%20in%20the%20Gulf%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3EMay%2011%3A%20%3C%2Fstrong%3EUS%20coastguard%20recovers%20%2480%20million%20heroin%20haul%20from%20fishing%20vessel%20in%20Gulf%20of%20Oman%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3EMay%208%3A%3C%2Fstrong%3E%20US%20coastguard%20vessel%20USCGC%20Glen%20Harris%20seizes%20heroin%20and%20meth%20worth%20more%20than%20%2430%20million%20from%20a%20fishing%20boat%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3EMarch%202%3A%3C%2Fstrong%3E%20Anti-tank%20guided%20missiles%20and%20missile%20components%20seized%20by%20HMS%20Lancaster%20from%20a%20small%20boat%20travelling%20from%20Iran%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3EOctober%209%2C%202022%3A%20%3C%2Fstrong%3ERoyal%20Navy%20frigate%20HMS%20Montrose%20recovers%20drugs%20worth%20%2417.8%20million%20from%20a%20dhow%20in%20Arabian%20Sea%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3ESeptember%2027%2C%202022%3A%3C%2Fstrong%3E%20US%20Naval%20Forces%20Central%20Command%20reports%20a%20find%20of%202.4%20tonnes%20of%20heroin%20on%20board%20fishing%20boat%20in%20Gulf%20of%20Oman%C2%A0%3C%2Fp%3E%0A
The specs
AT4 Ultimate, as tested
Engine: 6.2-litre V8
Power: 420hp
Torque: 623Nm
Transmission: 10-speed automatic
Price: From Dh330,800 (Elevation: Dh236,400; AT4: Dh286,800; Denali: Dh345,800)
On sale: Now
Key facilities
- Olympic-size swimming pool with a split bulkhead for multi-use configurations, including water polo and 50m/25m training lanes
- Premier League-standard football pitch
- 400m Olympic running track
- NBA-spec basketball court with auditorium
- 600-seat auditorium
- Spaces for historical and cultural exploration
- An elevated football field that doubles as a helipad
- Specialist robotics and science laboratories
- AR and VR-enabled learning centres
- Disruption Lab and Research Centre for developing entrepreneurial skills
LEADERBOARD
%3Cp%3E-19%20T%20Fleetwood%20(Eng)%3B%20-18%20R%20McIlroy%20(NI)%2C%20T%20Lawrence%20(SA)%3B%20-16%20J%20Smith%3B%20-15%20F%20Molinari%20(Ita)%3B%20-14%20Z%20Lombard%20(SA)%2C%20S%20Crocker%20(US)%3C%2Fp%3E%0A%3Cp%3E%3Cstrong%3ESelected%3A%20%3C%2Fstrong%3E-11%20A%20Meronk%20(Pol)%3B%20-10%20E%20Ferguson%20(Sco)%3B%20-8%20R%20Fox%20(NZ)%20-7%20L%20Donald%20(Eng)%3B%20-5%20T%20McKibbin%20(NI)%2C%20N%20Hoejgaard%20(Den)%3C%2Fp%3E%0A
Porsche Macan T: The Specs
Engine: 2.0-litre 4-cyl turbo
Power: 265hp from 5,000-6,500rpm
Torque: 400Nm from 1,800-4,500rpm
Transmission: 7-speed dual-clutch auto
Speed: 0-100kph in 6.2sec
Top speed: 232kph
Fuel consumption: 10.7L/100km
On sale: May or June
Price: From Dh259,900
How Filipinos in the UAE invest
A recent survey of 10,000 Filipino expatriates in the UAE found that 82 per cent have plans to invest, primarily in property. This is significantly higher than the 2014 poll showing only two out of 10 Filipinos planned to invest.
Fifty-five percent said they plan to invest in property, according to the poll conducted by the New Perspective Media Group, organiser of the Philippine Property and Investment Exhibition. Acquiring a franchised business or starting up a small business was preferred by 25 per cent and 15 per cent said they will invest in mutual funds. The rest said they are keen to invest in insurance (3 per cent) and gold (2 per cent).
Of the 5,500 respondents who preferred property as their primary investment, 54 per cent said they plan to make the purchase within the next year. Manila was the top location, preferred by 53 per cent.
Dhadak 2
Director: Shazia Iqbal
Starring: Siddhant Chaturvedi, Triptii Dimri
Rating: 1/5
What the law says
Micro-retirement is not a recognised concept or employment status under Federal Decree Law No. 33 of 2021 on the Regulation of Labour Relations (as amended) (UAE Labour Law). As such, it reflects a voluntary work-life balance practice, rather than a recognised legal employment category, according to Dilini Loku, senior associate for law firm Gateley Middle East.
“Some companies may offer formal sabbatical policies or career break programmes; however, beyond such arrangements, there is no automatic right or statutory entitlement to extended breaks,” she explains.
“Any leave taken beyond statutory entitlements, such as annual leave, is typically regarded as unpaid leave in accordance with Article 33 of the UAE Labour Law. While employees may legally take unpaid leave, such requests are subject to the employer’s discretion and require approval.”
If an employee resigns to pursue micro-retirement, the employment contract is terminated, and the employer is under no legal obligation to rehire the employee in the future unless specific contractual agreements are in place (such as return-to-work arrangements), which are generally uncommon, Ms Loku adds.
Killing of Qassem Suleimani
BMW M5 specs
Engine: 4.4-litre twin-turbo V-8 petrol enging with additional electric motor
Power: 727hp
Torque: 1,000Nm
Transmission: 8-speed auto
Fuel consumption: 10.6L/100km
On sale: Now
Price: From Dh650,000
Results
Stage three:
1. Stefan Bissegger (SUI) EF Education-EasyPost, in 9-43
2. Filippo Ganna (ITA) Ineos Grenadiers, at 7s
3. Tom Dumoulin (NED) Jumbo-Visma, at 14s
4. Tadej Pogacar (SLO) UAE-Team Emirates, at 18s
5. Joao Almeida (POR) UAE-Team Emirates, at 22s
6. Mikkel Bjerg (DEN) UAE-Team Emirates, at 24s
General Classification:
1. Stefan Bissegger (SUI) EF Education-EasyPost, in 9-13-02
2. Filippo Ganna (ITA) Ineos Grenadiers, at 7s
3. Jasper Philipsen (BEL) Alpecin Fenix, at 12s
4. Tom Dumoulin (NED) Jumbo-Visma, at 14s
5. Tadej Pogacar (SLO) UAE-Team Emirates, at 18s
6. Joao Almeida (POR) UAE-Team Emirates, at 22s
Pharaoh's curse
British aristocrat Lord Carnarvon, who funded the expedition to find the Tutankhamun tomb, died in a Cairo hotel four months after the crypt was opened.
He had been in poor health for many years after a car crash, and a mosquito bite made worse by a shaving cut led to blood poisoning and pneumonia.
Reports at the time said Lord Carnarvon suffered from “pain as the inflammation affected the nasal passages and eyes”.
Decades later, scientists contended he had died of aspergillosis after inhaling spores of the fungus aspergillus in the tomb, which can lie dormant for months. The fact several others who entered were also found dead withiin a short time led to the myth of the curse.
What sanctions would be reimposed?
Under ‘snapback’, measures imposed on Iran by the UN Security Council in six resolutions would be restored, including:
- An arms embargo
- A ban on uranium enrichment and reprocessing
- A ban on launches and other activities with ballistic missiles capable of delivering nuclear weapons, as well as ballistic missile technology transfer and technical assistance
- A targeted global asset freeze and travel ban on Iranian individuals and entities
- Authorisation for countries to inspect Iran Air Cargo and Islamic Republic of Iran Shipping Lines cargoes for banned goods
Anghami
Started: December 2011
Co-founders: Elie Habib, Eddy Maroun
Based: Beirut and Dubai
Sector: Entertainment
Size: 85 employees
Stage: Series C
Investors: MEVP, du, Mobily, MBC, Samena Capital
At a glance
Global events: Much of the UK’s economic woes were blamed on “increased global uncertainty”, which can be interpreted as the economic impact of the Ukraine war and the uncertainty over Donald Trump’s tariffs.
Growth forecasts: Cut for 2025 from 2 per cent to 1 per cent. The OBR watchdog also estimated inflation will average 3.2 per cent this year
Welfare: Universal credit health element cut by 50 per cent and frozen for new claimants, building on cuts to the disability and incapacity bill set out earlier this month
Spending cuts: Overall day-to day-spending across government cut by £6.1bn in 2029-30
Tax evasion: Steps to crack down on tax evasion to raise “£6.5bn per year” for the public purse
Defence: New high-tech weaponry, upgrading HM Naval Base in Portsmouth
Housing: Housebuilding to reach its highest in 40 years, with planning reforms helping generate an extra £3.4bn for public finances
The specs
Price, base / as tested Dh960,000
Engine 3.9L twin-turbo V8
Transmission Seven-speed dual-clutch automatic
Power 661hp @8,000rpm
Torque 760Nm @ 3,000rpm
Fuel economy, combined 11.4L / 100k
UPI facts
More than 2.2 million Indian tourists arrived in UAE in 2023
More than 3.5 million Indians reside in UAE
Indian tourists can make purchases in UAE using rupee accounts in India through QR-code-based UPI real-time payment systems
Indian residents in UAE can use their non-resident NRO and NRE accounts held in Indian banks linked to a UAE mobile number for UPI transactions
TV: World Cup Qualifier 2018 matches will be aired on on OSN Sports HD Cricket channel
Infiniti QX80 specs
Engine: twin-turbocharged 3.5-liter V6
Power: 450hp
Torque: 700Nm
Price: From Dh450,000, Autograph model from Dh510,000
Available: Now
The White Lotus: Season three
Creator: Mike White
Starring: Walton Goggins, Jason Isaacs, Natasha Rothwell
Rating: 4.5/5
