Protecting Applications

Most of the code in a modern program wasn't written by the people who sell it. The online bookstore's shop software, which it rents from a small software company, is built on dozens of free libraries, collections of code that other programmers wrote once so nobody has to write them again: one to read dates, one to resize book covers, one to write the log of everything the shop does. A flaw in any of them is a flaw in the shop.

One of the most widely used of those libraries is Log4j, free code from the Apache Software Foundation that programs written in Java use to keep their logs. In late November 2021 an engineer at Alibaba Cloud told Apache that Log4j had a flaw, soon nicknamed Log4Shell. When a line to be logged contained a certain kind of text, Log4j read that text as an instruction: it contacted a server the text named and could load and run code from it. Programs log what users send them, from a chat message to the name of the browser, so anyone who could get a line of text logged could often take over the server. It drew wide attention through Minecraft servers, where typing a message in the game's chat could set it off.

The flaw scored 10 out of 10 for severity. Jen Easterly, director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), called it "one of the most serious I've seen in my entire career, if not the most serious."

Apache's first fix, on December 10, proved incomplete, and the figure shows three more within three weeks. Even so, finding Log4j was harder than installing the fixes, since it was buried inside other libraries and inside products bought from vendors, often several layers down, and one federal department reported spending 33,000 hours on its response. In July 2022 the federal review board that studied the event called Log4j an "endemic vulnerability" that would remain in systems "for many years to come, perhaps a decade or longer."

The bookstore's owner can't read the code of every library the shop uses, so whether the shop is safe depends on choices its software company makes long before the owner sees it. In April 2023, with Easterly as its director, CISA and its counterparts in six other countries asked software makers to carry that weight themselves. Their joint guidance called it secure by design.

Read against Log4Shell, the principles are concrete. With a list of every library in its product, a maker can tell quickly whether it is affected, where others spent days searching. Telling customers early, even when the news is embarrassing, gives them time to act before an adversary does. And leaders who drop other work for a flaw like that get the update out first.

The owner can't see inside the shop software. What can the owner check from outside, before signing the next year's contract?

The owner can check what the company publishes and what it ships. Security notices that name the flaw, the versions affected, and the fix say more than a line about taking security seriously. A list of the libraries inside the product shows whether the company could tell quickly if Log4j was inside it. And a new shop on its first day, before anyone changes a setting, shows what the company thinks a customer should get without asking.

For the shop software, secure by default would mean the owner's sign-in requires a second factor from the start, the page for managing the shop isn't reachable from the whole internet until the owner opens it, and updates install themselves unless someone turns that off. Each of those is a setting the owner would otherwise have to know about and remember.

Log4Shell was an input problem, like the injection attacks: text a visitor supplied was treated as an instruction. The shop software has the same kind of opening in its search box, where a visitor types a title and the program puts it inside a query to the book database.

A customer searches for Charlotte's Web. What happens to that search if the function strips every single quote?

The search becomes Charlottes Web, and it may miss the book. Titles carry apostrophes, quotation marks and semicolons for ordinary reasons, so the software company's code does two things. It refuses input that can't be a title at all, such as a thousand characters or angle brackets. For the rest, it hands the database the title as a separate value that can only be compared and never run, so the apostrophe stays in the search and can't end the query early. When the program writes the title back onto the results page, it turns any angle brackets into harmless symbols that display as text.