Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' scan of the Internet

blog.erratasec.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Bash 'shellshock' scan of the Internet

#21

Post by agwa »

gojomo wrote: post #10
agwa wrote: post #2

I've been monitoring my Apache logs all day for the string "() {". So far Robert Graham's scan is the only match. This is what the log entry looks like: 209.126.230.72 - - [24/Sep/2014:22:07:56 +0000] "GET / HTTP/1.0" 403 492 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"

Someone not wanting to stick out might only probe headers that are less-often logged, but still possibly passed-along as environment variables. Has anyone logged 'HTTP_FROM' in a long while?

Excellent point.

Apache actually passes along any HTTP header, even undefined ones, as CGI environment variables (of the form $HTTP_HEADERNAME) so an attacker could just make up a header and it would be very unlikely to be logged.

Re: Bash 'shellshock' scan of the Internet

#22

Post by agwa »

dsl wrote: post #8
gcr wrote: post #6

Earlier quoted context omitted.

Who would grant `sudo` privileges to `www-data` without asking for a password? That's just asking for a bad time.

The same people who write CGI applications in bash?

Your CGI application does not need to be written in bash for you to be vulnerable. If at any point your non-bash CGI program (and this includes PHP, even with mod_php, since it sets the same environment variables), or one of its descendant processes, executes a bash script, you can be exploited.

This is especially bad on systems where /bin/sh is /bin/bash, since /bin/sh gets invoked implicitly by system(3). So you could have a non-bash CGI program invoking a non-bash program using system(3) and you can be exploited.

Re: Bash 'shellshock' scan of the Internet

#23

Post by peterhu »

agwa wrote: post #22
dsl wrote: post #8

Earlier quoted context omitted.

The same people who write CGI applications in bash?

Your CGI application does not need to be written in bash for you to be vulnerable. If at any point your non-bash CGI program (and this includes PHP, even with mod_php, since it sets the same environment variables), or one of its descendant processes, executes a bash script, you can be exploited. This is especially bad on systems where /bin/sh is /bin/bash, since /bin/sh gets invoked implicitly by system(3). So you co…

According to https://access.redhat.com/articles/1200223, mod_php is not vulnerable.

Re: Bash 'shellshock' scan of the Internet

#24

Post by nitrogen »

ilaksh wrote: post #19

To be vulnerable to this I need to be running CGI scripts right? I have my system set up with reverse nginx proxies and haproxy TCP mode pass through to things like nginx static files and Node.js servers. Can he run his ping command on my servers? I am thinking not.

No, CGI is just the most obvious use of user-controlled environment variables. Other systems may also set environment variables to user-controlled strings for whatever reason. If such a system ever invokes bash, even indirectly or implicitly, with user-controlled environment variables set, that system is vulnerable.

Example non-CGI vulnerable systems from RedHat: CUPS, dhclient.

Re: Bash 'shellshock' scan of the Internet

#25

Post by ilaksh »

nitrogen wrote: post #24
ilaksh wrote: post #19

To be vulnerable to this I need to be running CGI scripts right? I have my system set up with reverse nginx proxies and haproxy TCP mode pass through to things like nginx static files and Node.js servers. Can he run his ping command on my servers? I am thinking not.

No, CGI is just the most obvious use of user-controlled environment variables. Other systems may also set environment variables to user-controlled strings for whatever reason. If such a system ever invokes bash, even indirectly or implicitly, with user-controlled environment variables set, that system is vulnerable. Example non-CGI vulnerable systems from RedHat: CUPS, dhclient.

Can someone from the internet use this type of attack through CUPS or dhclient then? I was asking about external attacks, not users that are already on the system.

Re: Bash 'shellshock' scan of the Internet

#26

Post by nitrogen »

ilaksh wrote: post #25
nitrogen wrote: post #24

Earlier quoted context omitted.

No, CGI is just the most obvious use of user-controlled environment variables. Other systems may also set environment variables to user-controlled strings for whatever reason. If such a system ever invokes bash, even indirectly or implicitly, with user-controlled environment variables set, that system is vulnerable. Example non-CGI vulnerable systems from RedHat: CUPS, dhclient.

Can someone from the internet use this type of attack through CUPS or dhclient then? I was asking about external attacks, not users that are already on the system.

dhclient: sort of. If you connect to a malicious access point, or someone runs a rogue DHCP server on a network you trust, they could potentially attack dhclient.

CUPS: If you are exposing a CUPS server to the Internet to allow remote printing.

Re: Bash 'shellshock' scan of the Internet

#27

Post by ilaksh »

nitrogen wrote: post #26
ilaksh wrote: post #25

Earlier quoted context omitted.

Can someone from the internet use this type of attack through CUPS or dhclient then? I was asking about external attacks, not users that are already on the system.

dhclient : sort of. If you connect to a malicious access point, or someone runs a rogue DHCP server on a network you trust, they could potentially attack dhclient. CUPS : If you are exposing a CUPS server to the Internet to allow remote printing.

OK so are those the only ones you know of? I am going to patch but just wondering about this category of attack in a more general sense so want to make sure I understand the scope of this particular one.

So say I have a server that is running a VPN (tinc). Then another system is connected to that same VPN network. Are you saying that by running a DHCP server on the second system, my server could be compromised?

Re: Bash 'shellshock' scan of the Internet

#28

Post by lcedp »

Now I see him

    209.126.230.72 - - [25/Sep/2014:07:43:58 +0300] "GET / HTTP/1.0" 200 151 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
..and someone else

    89.207.135.125 - - [25/Sep/2014:12:51:01 +0300] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 168 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"

Re: Bash 'shellshock' scan of the Internet

#29

Post by piran »

lcedp wrote: post #28

Now I see him 209.126.230.72 - - [25/Sep/2014:07:43:58 +0300] "GET / HTTP/1.0" 200 151 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" ..and someone else 89.207.135.125 - - [25/Sep/2014:12:51:01 +0300] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 168 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"

I just saw something from 89.207.135.125 -- no idea who that is.

Re: Bash 'shellshock' scan of the Internet

#30

Post by joeshaw »

The DHCP attack vector is the one that is scariest to me. We know that dhclient on Linux is vulnerable, but the number of unpatched Linux machines on a public wifi network will likely be too small to be worthwhile to try to capture. Macs on the other hand are prevalent in places like coffee shops, and Apple is notoriously slow to patch security vulnerabilities in their operating systems. Has anyone done much analysis on OS X's vulnerability to this bug?
Post reply on HN