Though simple and easy to execute, the attacks on Log4j are not so easy to bottle up given the ubiquity of the tool (particularly in open source packages that countless servers and sites rely on). The security hole stems from Minecraft, of all places, where gamers discovered that arbitrary code could be executed through the chat feature by signaling the remote machine to log it. Log4j has certainly thrown a scare into both governments and private enterprise. MIIT has a cooperative partnership with Alibaba Cloud for data sharing regarding cybersecurity threats and monitoring of platforms, something that will apparently be mothballed until mid-2022.

The Alibaba researchers, possibly overcome with how serious the Log4j vulnerability (Log4Shell) could be for the world, seem to have overlooked this step. Alibaba Cloud takes a hit over Log4j reportingĪs part of a package of new security and data protection regulations passed in 2021, Chinese regulators expect to be informed of discovered vulnerabilities before they are disclosed to the public. The state is one of its largest customers, and one that it relies on more heavily since ByteDance opted to move to its own international cloud storage earlier this year. The consequence will be a suspension of the cybersecurity relationship between the Chinese government and Alibaba Cloud for six months, something that could be costly for the tech and retail giant. The Ministry of Industry and Information Technology (MIIT) is taking Alibaba to task over not reporting the breach to its officials first.

Apache ant log4j vulnerability