The security flaw that's freaked out the internet

Security pros say it's one of the worst computer vulnerabilities they've ever seen. They say state-backed Chinese and Iranian hackers and rogue cryptocurrency miners have already seized on it.

Detected in an extensively used utility called Log4j, the flaw lets internet-based attackers easily seize control of everything from industrial control systems to web servers and consumer electronics. For cybercriminals and digital spies, it allows easy, password-free entry.

Simply identifying which systems use the utility is a challenge, It is often hidden under layers of other software.

The affected software, written in the Java programming language, logs user activity on computers. Developed and maintained by a handful of volunteers under the auspices of the open-source Apache Software Foundation, it is extremely popular with commercial software developers.
It runs across many platforms _ Windows, Linux, Apple's macOS _ powering everything from web cams to car navigation systems and medical devices, say experts.

Security pros have an even more daunting challenge: trying to detect whether the vulnerability was exploited. Some believe it is just a matter of time before malicious actors start exploiting what they have hacked.