Security breach Quebec has to shut down its websites

A major computer security breach that is causing headaches worldwide has forced the Quebec government to block nearly 4,000 Internet sites and services, making it time to see more clearly and resolve the issue.

This error, called “Log4Shell”, is related to a Java library called Log4j and was developed by free software called Apache. Violation allows the hacker to execute arbitrary codes remotely on the server and gain control over it.

At a news conference on Sunday, Eric Khair, the minister responsible for access to information and protection of personal information, assured that “to date, we have no indication that we will be subjected to a successful attack.”

He explained that many sites need to be shut down while checking whether the Log4j Java library is being used as a “monk job”. “We need to scan all our systems,” he said. We are looking for a needle in a haystack. “

The sites of the Education and Health Network, as well as Revenue Quebec, were particularly affected. Sunday evening, for example, will not be able to access clicSÉQUR. On its site, the University of Sherbrook wrote that it had closed access to some computer systems, so it was time to check. Vaccine passport and appointment booking system for vaccine are not affected.

Fixed fixes that made the sites’ re-accessible or confirmed that they were not using the problematic element. The minister could not say when this major operation will end.

In Ottawa, the sites of various ministries were also closed in advance. This is especially true in the case of the secure portal Mon Dossier on the Canada Revenue Agency (CRA) website, which is temporarily unavailable from December 10 and will also be available on Sunday evenings.

“There are currently no indications that the agency systems were compromised due to this vulnerability or that there was unauthorized access to confidential taxpayer information,” the CRA said in a statement. Destiny, Without specifying when the services will be available again.

For its part, the Canadian Center for Cyber ​​Security “strongly recommends that companies review internally vulnerable applications”, warning that “due to the widespread use of the Log4j library in public infrastructure, many applications may be compromised by third parties”.

Many were affected

“It’s a disaster from a global perspective,” said Jean-Philippe Deckary-Mathews, head of cyber security at the Commissioners du Quebec. “It’s very serious, because it affects remote code implementation and anyone who has a Java application with this library. There are a lot of users. “

Several governments, including the United States, Australia and New Zealand, have also issued warnings about this vulnerability.

Patrick Mathew, a computer security expert and co-founder of HackFest, adds that it is very easy for a hacker to exploit the error and does not require much computer knowledge. “It’s very easy, it gives mega-companies access in a few clicks,” he says. It is not impossible for a hacker to seize personal data after controlling the server. With Thursday revealing the error, many have tried to make use of it. Patrick Matthew therefore believes that the importance of taking corrective action quickly is that governments have made the right decision by shutting down their sites.

With the Canadian Press

Watch the video