Race against the clock when the security hole needs to be repaired

When it recently became known that two serious security holes had been discovered, the National Cyber ​​Security Center, part of the FRA, issued a so-called flash message containing a number of recommendations to Swedish authorities, institutions and companies. Since then, IT security departments around the world have been busy.

- The focus is on making the required security update, but it is also important to identify where in the systems PHP has been used. It can be found in many places, says David Jacoby, Swedish IT security expert at Syndis.

According to him, authorities and large companies have been quick - while a very large part of the internet has not yet had time to fix what is required. A challenge is all purchased services and hardware in the network – such as firewalls and routers – as they also run PHP.

- In addition to web services and websites, it also affects physical gadgets such as so-called "smart devices" such as charging boxes, home routers, printers, surveillance cameras and medical technology systems that run the vulnerable programming language, says David Jacoby.

The problem is that the security update (a "patch") that was released yesterday also contains the blueprints for what was fixed. It can be used by cybercriminals and hackers to build tools to exploit the vulnerability.

- It turns into a cat-and-mouse game. Anyone who cannot update their systems immediately should turn off access to their systems. The security holes mean that neither a username nor a password is required to enter the system. It's like 70 percent of all doors are unlocked, you don't even need a crowbar to get in, says David Jacoby.

The full extent of the damage caused by the security failure will only be felt in retrospect.

- Historically, intrusions occur long before the consequences of ransomware or leaks on the dark web become visible. For ordinary users, it is important to be on your guard and change your usernames and passwords, so that a data leak from a hacked site does not lead to other accounts being compromised. The only thing we know right now is that it is obvious that it will cause problems, continues David Jacoby.

The National Cyber ​​Security Center, NCSC, will follow developments closely during the day. Those organizations that fail to install the security update immediately are asked to isolate the system from the Internet until it is fixed.

- In the meantime, it is up to the system owners to search for signs of intrusion or other suspicious activity, says Ola Billger at FRA.

Although the vulnerability is described as serious – 9.2 on a scale of 1-10 according to Computor Sweden – the ordinary citizen need not be worried. But everyone should be careful with the information they share on the internet. It is the organizations that are responsible for security updating php, according to Ola Billger.

- For example, banking services have a completely different level of security and are likely not affected by this, he says.

On the other hand, web pages where the individual has provided information about username, password and credit card number may be exposed.