Joseph Menn

SAN FRANCISCO – A U.S.-based agency that is charged with defending the nation from hacking claims Tuesday that most attacks made using a newly disclosed flaw within open-source software have been minor. Some of these attackers are trying to steal computing power in order to mine cryptocurrency.

Officials at the Cybersecurity and Infrastructure Security Agency said they had not confirmed reports by multiple security companies of ransomware installations or attempts by other governments to steal secrets.

“We are not seeing widespread, highly sophisticated intrusion campaigns,” Eric Goldstein, executive assistant director for cybersecurity at CISA, said in a call with reporters.

He warned that the threat will continue to grow and that the agency was working hard to gather reliable information about the types of software at risk.

He stated that it is possible for widespread vulnerabilities to routers and other consumer devices. The Department of Homeland Security’s unit was working with vendors in order to deploy the necessary patches.

Log4j is a commonly used logging tool. The flaw has been carried on by hundreds of other programs which rely upon it. The flaw can be easily exploited, Goldstein stated.

Even though the tool is patched since Dec. 6, most other programs must also implement it to prevent an attacker from gaining deep network access.

CISA recently gave power to all federal agencies and directed them to use patches when they became available.

Goldstein said there have been no reports of intrusions using the vulnerability in the government, but CISA expects “all manner of adversaries” to seek to exploit the flaw.

You can submit live code to the logging function, which will search for and then install it. Hackers may use this to access servers and gain more control.

Although the bug has been known for many years in Log4j, it was discovered recently by a Chinese researcher. Alibaba (NYSE:), and was reported to the volunteer group that maintains the program. The flaw was discovered by the Chinese security firm and exposed to the public before the Apache Software Foundation (NASDAQ:) could release the fix.

Goldstein said it was “concerning” any time a flaw is exploited before a patch is out. Recent Chinese laws require security personnel to report any flaws quickly to the government, sometimes before patch releases.