Log4Shell
A critical vulnerability revealed in December 2021 in a logging library present in countless software products, the reference case of latent accumulation: everyone was exposed without knowing it.
Log4Shell is the name given to a vulnerability in Log4j, an open-source Java logging library, revealed on December 9, 2021. It let an attacker run code remotely on a server simply by making it log a chosen string, without authentication, and it received the maximum severity score. Its gravity lay less in the technique than in the library's ubiquity, embedded in thousands of commercial products and online services, often several layers deep in dependencies, so that organizations mostly did not know whether they used it. For insurance, Log4Shell is the archetype of latent accumulation. Overnight, a considerable share of cyber portfolios became exposed to the same flaw, and the potential loss depended only on each organization's patching speed and on attackers' interest. Actual accumulation turned out far smaller than potential accumulation, thanks to rapid mobilization, but the episode accelerated demand for software bills of materials and thinking about widespread event exclusions.
The director of the US cybersecurity agency described Log4Shell as one of the most serious flaws she had seen in her entire career. The vulnerability, scored 10 out of 10, was exploited within hours of its disclosure in December 2021, including by state-linked groups.
Log4Shell, CVE-2021-44228, Log4j vulnerability
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.