Good afternoon all and Happy New Year! I am sure you all have heard or read about the Log4J issues currently happening, (Some people are calling it Log4Shell), and I wanted to reach out and talk a little bit about this issue as well as computer security and inform people about what works and can help keep these things at bay.

Since the topic of computer security is pretty lengthy, especially in today's environment, I am going to break up this information over a few emails and attempt to not bore anyone, yet still supply enough information to be of real help. Like most things, a few preventative measures can help ensure security for this as well as many other nasty internet issues.

And, if you prefer to read or print this information, below in this email you will find a link to my website with PDF files which have all this information as well, and I encourage you to read the emails or download the PDF's and read them, keep them and refer to them again. And please share them if you like, with your friends, relatives or business associates as these people are your closest link to issues, through email, so help them help you.

Let me start off by saying congratulations! If I have created your website, developed an application for you use, or have worked at getting eset anti-virus onto your computers, then you are in a better place already! As many of you already know, eset is my preferred anti-virus and while no defense system is 100%, eset is one of the best I have found, and when protected by it, you have already taken a major step in preventing serious issues.

Long ago, (I embarrass myself by saying almost 30 years ago! ) I made the decision in my programming to not "include other people's code and libraries" in my products and websites. While this inclusion of code made the programming easier, I have always believed that using unknown code and libraries is a far too dangerous a practice, and one that I am unwilling to risk. And while there are always some libraries we have to include in our code, we must know that these come from safe entities, which maintain their code and work diligently at security.

Unfortunately, many programmers do not adhere to this safer practice, and so we are seeing the wide spread issues of Log4J and their effects. I urge you to have caution during the next few months and be suspicious of unknown emails, unknown 'movement' spotted in your accounts, websites or online places you visit. Question anything that is suspicious to you and ask about it. And please, as always, do not hesitate to ask me if you have a question!

The gory details of Log4J I shall spare you from, but the bottom line is that the security issue in this code affects an extremely large portion of the internet, many Java based applications, and many underlying code libraries. The current result of the problematic code is causing compromised computers and systems with disastrous results. Log4J is used by just about every cloud service and enterprise provider on the internet, and the issue that has been uncovered provides a method of “machine compromise” which means that a hacker may be able to take control of the computer or system. Needless to say, this delivers almost any data on that computer / system into the hands of the bad guys!

Worse, there is little method for you to directly check if a website or application you use daily is affected. Really your only defense here is if the code, application or website is properly maintained and security patches are being applied by the vendor of that website or application. All you can really do is to ask if the systems are safe, make sure your anti-virus is updated and watch for anything suspicious.

On your own computer, if this issue is embedded in an application your running, then you may see alerts from antivirus, or strange behavior on your computer. (things moving around, computer not shutting down / and or firing up at weird times, files open that were not open before, etc..) If you see ANY of these kind of things, please do not hesitate to reach out - it is always better to be safe with a false alarm then find an issue much later!

As I said earlier, the topic of computer security is a large topic, and the segue between problems and security has far reaching effects as well many methods to prevent and resolve issues. In the next email we shall dive into ransomware and begin the lengthy topic of email security.

pdf version of this article located here

article:220108