Security experts are warning that a serious flaw named Shellshock could be about to affect many of the world’s web users. This article, culled from TheGuardian, is about what you just must know and do NOW to be safe. Here’s what you should know and do.
 |
| One of the major worries is that attackers will use Shellshock to create worms – attacks that automatically replicate across machines. |
The US government-backed National Vulnerability Database rated Shellshock 10/10 for severity. Here’s a simple guide to what the Bash bug is, why it matters and what people can do to help prevent future attacks.
What is Bash?
Bash, an acronym for Bourne Again Shell, is a command-line shell. This lets users issue commands to launch programs and features within software by typing in text. It’s typically used by programmers and shouldn’t be open to the wider world, though Shellshock changes that.Mac OS X users can run it by opening up their Terminal, as can anyone using the Linux operating system by launching the same machine. Linux and Mac OS X are largely derivatives of the Unix OS, so share some features.
What is the vulnerability and how might attackers exploit it?
The 25-year-old vulnerability is related to the processing of what are known as “environment variables” in Bash, which provide a way to influence the behaviour of software.The Bash bug, discovered by the Linux expert Stéphane Chazelas, is causing concern as the command-line interface is used by many popular tools to run those environment variables.
In theory, an attacker could exploit a machine running Bash by forcing it to set specially crafted environment variables. This could then be further exploited to let them execute shell commands, i.e. run programs on other people’s computers. That’s endgame for the victims - their machines would in effect be in the control of the hacker.
In slightly more detail, when dealing with environment variables, Bash shouldn’t continue to process commands that come after the “function definition” - the declaration of a software routine that performs a certain task. But it does and therefore allows for an outsider to send exploit code via software that uses Bash and have it run commands. They should never be able to do that.
For instance, the widely deployed Apache web server software has Bash run in the background to parse CGI scripts - little programs that process data from web users, such as when they enter information into a form. As there’s no authentication on these CGI scripts, a hacker could call them with a web request and include lines of exploit code, which would then set malicious variables on the server via Bash. From there, they could play with programs on the server, including the website itself to launch further attacks on visitors, hence the fear of widespread impact. This is believed to be the most likely attack vector.
However, this is all hypothetical right now. There have been no reports of real world attacks exploiting this flaw. But most experts believe they will emerge, as Bash is so widely used.
“What we think will cause significant issues is that people will find plenty of unexpected ways to trigger this vulnerability and that means its scope will be wider than appreciated, and this might have a detrimental impact,” Robert Horton, managing director of NCC Group’s European Security Consulting division, told the Guardian.
“A lot of systems do appear to be remotely vulnerable to this which means the impact of this has the potential to be large and much more pervasive than Heartbleed.”
One of the major worries is that attackers will use Shellshock to create worms – attacks that automatically replicate across machines. “In theory, this could take the form of an infected machine scanning for other targets and propagating the attack to them,” noted security expert Troy Hunt. “This would be by no means limited to public-facing machines either; get this behind the corporate firewall and the sky’s the limit.”
Is my Mac vulnerable?
Horton said: “There may be potential implications for Mac OS X. In the desktop scenario this risk may manifest itself in certain client software scenarios where scripts take untrusted input from the network.“Also as with Linux where it is used as a server it may also be vulnerable. Details have been made available on how to mitigate it for very technical users . For less technical users it is advisable to wait for an official patch from Apple.”
Apple hasn’t yet responded to a request for comment.
Using test code supplied by security firm Qualys here, Mac OS X 10.9.4 is vulnerable. It’s worth opening up Terminal (search for it in Finder) to copy and paste that text into Bash and running it (by pressing Enter). This won’t affect the security of the machine, don’t panic!
Linux users should check the websites of those managing their distribution, whether that’s RedHat, Ubuntu, Debian, CentOS or any of the other myriad operating systems.
What should I do now?
It’s obvious, but many don’t do it, despite being warned: patch your systems now. Anyone hosting a website running the affected operating systems should certainly move as quickly as possible.All of those OS-specific sites linked above have instructions on how to update, with all the necessary files. Information can also be found on the SecLists advisory website.
Time for the bad news: there’s some concern the patches aren’t wholly effective. “Third parties have found the initial patches have not been comprehensive in nature. However, they do limit the attack surface,” said Horton.
Anyone who can afford it should look to their monitoring and web application firewalls to look out for any attacks. Other than that, it’s time to cross some fingers and hope attackers don’t outsmart the defenders.
This article was originally published by TheGuardian under the title "What is the Shellshock bug? Is it worse than Heartbleed?" here.
what kind of a world are we into? you mean my sensitive data have been open to pranksters all these years?
ReplyDeleteNo, this article doesn't mean your data have been open to pranksters, its just that a serious flaw in website systems that have been there for a long time, and a smart guy called Stéphane Chazelas just discovered it recently. That's the issue here.
Delete