Chinese and Iranian hackers exploit Log4j computer flaw, affecting hundreds of millions

Security pros say one of the worst computer vulnerabilities they've ever seen has been exploited by state-backed Chinese and Iranian hackers, rogue cryptocurrency miners, and others.

Lodged in an extensively used utility called Log4j, the flaw lets internet-based attackers easily seize control of everything from industrial control systems to web servers and consumer electronics. Simply identifying which systems use the utility is a challenge; it is often hidden under layers of other software.

The top U.S. cybersecurity defense official, Jen Easterly, deemed the flaw "one of the most serious I’ve seen in my entire career, if not the most serious" in a call Monday with state and local officials and partners in the private sector. Publicly disclosed last Thursday, it’s catnip for cybercriminals and digital spies because it allows easy, password-free entry.

The Cybersecurity and Infrastructure Security Agency, or CISA, which Easterly runs, stood up a resource page Tuesday to deal with the flaw it says is present in hundreds of millions of devices. Other heavily computerized countries were taking it just as seriously, with Germany activating its national IT crisis center.