Eric Geller

Eric Geller @ericgeller

CISA needs help assembling a complete list of affected software, Goldstein said. "If anybody sees a product that they think is vulnerable and is not on our page, please, there is an easy way on the page to upload or to notify us [about] that vulnerable product." — PolitiTweet.org

Eric Geller @ericgeller

More from Goldstein: "Agencies have taken this with the utmost seriousness and have made extraordinary progress" toward patching affected software or mitigating the vuln. CISA has given agencies until 12/24 to apply any existing patches, and mandate will remain for new ones. — PolitiTweet.org

Eric Geller @ericgeller

CISA estimates that "hundreds of million" of devices are affected by the #log4j vulnerability because of how widely the code is used, Goldstein said. That number is likely to grow. “Many of these products are in use in organizations across the country, federal and non-federal.” — PolitiTweet.org

Eric Geller @ericgeller

U.S. critical infrastructure companies "are taking urgent mitigation steps," Goldstein said, "and thus far have been able to do so without a material impact to their critical functions or services." CISA has not yet seen any impact to what it calls "national critical functions." — PolitiTweet.org

Eric Geller @ericgeller

Goldstein: "At this point in time, we are not seeing widespread, highly sophisticated, damaging intrusion campaigns, but certainly we are deeply concerned about the prospect of adversaries using this vulnerability to cause real harm..." — PolitiTweet.org

Eric Geller @ericgeller

Goldstein: "We are not able to attribute any activity related to this vulnerability to specific actors." He urged anyone who knows of an affected product not on CISA's existing list to report it to the agency immediately. — PolitiTweet.org

Eric Geller @ericgeller

.@CISAgov is not aware of any hacks of federal agencies using the #log4j vulnerability, senior official Eric Goldstein said during a briefing with reporters tonight. Most attacks on vulnerable targets right now are low-level crypto miner deployments, he says. — PolitiTweet.org

Eric Geller @ericgeller

@pablohidalgo Karen Traviss is the perfect SW luminary for an NFT, change my mind — PolitiTweet.org

Eric Geller @ericgeller

"The Thwaites ice shelf could collapse within the next three to five years, unleashing a river of ice that could dramatically raise sea levels." https://t.co/jAAwqlu3Ov https://t.co/jBp0xckAgs — PolitiTweet.org

Eric Geller @ericgeller

@LindseyOD123 @SecMayorkas same idea — PolitiTweet.org

Eric Geller @ericgeller

Asked about the U.S. pressure campaign against NSO Group, which is straining under export control restrictions, Mayorkas says, "The technological innovations must adhere to our values and principles in the cyber environment and more broadly." — PolitiTweet.org

Eric Geller @ericgeller

Asked if the recent ransomware avalanche has subsided, Mayorkas says, "I don't think we're there yet." "Some of the major players" may be less active or temporarily dormant, but "that doesn't necessarily mean that they have gone away," and govt can't let up the pressure. — PolitiTweet.org

Eric Geller @ericgeller

@SecMayorkas "We as a department have to lead by example," Mayorkas says. "We're really investing a great deal of money as well as attention and focus on this program." — PolitiTweet.org

Eric Geller @ericgeller

DHS is launching a bug bounty program to offer hackers rewards for reporting flaws in its systems, @SecMayorkas says at Bloomberg conference. $500-$5k bounties. DHS will verify each vuln w/in 48hrs and fix it (or, if it's complex, develop a plan to fix it) w/in 15 days. — PolitiTweet.org

Eric Geller @ericgeller

@C_C_Krebs what GIF reflects how you would have responded if you'd been informed about this at the time? — PolitiTweet.org

Eric Geller @ericgeller

More evidence of the insecurity of mobile (and especially blockchain) voting systems: The USPS secretly tested one before the 2020 election, apparently without involving federal cyber experts, and independent researchers shredded it to pieces. https://t.co/c5tBY40mML https://t.co/k5kBZfHnSv — PolitiTweet.org

Eric Geller @ericgeller

👀 https://t.co/c5um42a3sS — PolitiTweet.org

Eric Geller @ericgeller

@petridishes do NOT ask me which famous person I am related to — PolitiTweet.org

Eric Geller @ericgeller

https://t.co/uOfHRSFyRG https://t.co/EOYaKpDy3M — PolitiTweet.org

Eric Geller @ericgeller

@A_single_bear this is haunting — PolitiTweet.org

Eric Geller @ericgeller

@kristenkbates so it's an intahview — PolitiTweet.org

Eric Geller @ericgeller

Very clear and helpful summary of the critical #log4j vulnerability. (h/t @NSA_CSDirector) — PolitiTweet.org

Eric Geller @ericgeller

.@bartongellman: "What we're for as journalists is truth. ... We have only one party that is prepared to lose a legitimate election and another one that's prepared to win by sacrificing the essential elements of democracy." https://t.co/9Gu77hbLyc — PolitiTweet.org

Eric Geller @ericgeller

hmmm https://t.co/NE1QClHv6l https://t.co/8tCRg1fejZ — PolitiTweet.org

Eric Geller @ericgeller

in case anyone missed this — PolitiTweet.org

Eric Geller @ericgeller

https://t.co/O6lkXdAQkQ https://t.co/kxFAWcAcWm — PolitiTweet.org

Eric Geller @ericgeller

@sparksjls meee-YOW — PolitiTweet.org

Eric Geller @ericgeller

@morningmoneyben CONFESSION is the new SCOOP — PolitiTweet.org

Eric Geller @ericgeller

@justinjm1 somehow, pandemic has returned — PolitiTweet.org

Eric Geller @ericgeller

@Grace_Segers Grace I'm so excited for the last season — PolitiTweet.org