shellshock_detector.lua seems to let this more obscure exploit slip by, undetected:
http://seclists.org/oss-sec/2014/q3/696 http://seclists.org/oss-sec/2014/q3/734
Easy, realtime, system-wide Shellshock monitoring
21–30 of 34 posts
Re: Easy, realtime, system-wide Shellshock monitoring
#22Earlier quoted context omitted.
Correct. It will log time, process name/pid, and what's going to be executed.
Why not actually also stop them?
That can get tricky as a general case, but would probably work OK for most people in this specific case. But, then again, hopefully you've patched bash already anyway, so blocking hosts that are scanning for a vulnerability that you've already fixed probably won't accomplish much.
Generally speaking, if you use something like iptables to block abusive hosts, you dive head-first into a very deep rabbit hole. Usually sysadmins don't want hosts blocked forever or iptables with 30k+ lines in them, so now you have to also add some kind of automated ban-clearing feature. Then you want to make sure you don't ban certain networks, so now you have to have some kind of whitelist feature. Then sysadmins will want to be able to tune which networks are trusted and which aren't, so now you have to add some configuration options for it. And so on.
I've written some software for my servers that does this for several different annoyances, and I spend almost as much time tuning the software as I spent dealing with the annoyances in the first place.
If sysadmins really want to auto-ban abusive hosts, you're probably better off letting them do it with something like Fail2Ban, and then all that muckety-muck becomes their problem, and not yours.
Re: Easy, realtime, system-wide Shellshock monitoring
#23Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)? Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
I have some truly old (disk) images going back to around 2003. I've looked through them and found nothing.
What freaks me out though is that these systems were vulnerable. All this time; it was right there. Its like finding out you just drove from LA to NYC with nothing but a single loose lug nut on your left front tire.
Re: Easy, realtime, system-wide Shellshock monitoring
#24Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)? Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.
How complete is your log? Does it log every header, or just User-Agent?
Now that the exploit is public, people don't care anymore, but anyone who knew about this bug and tried to exploit it before it was public would be careful to avoid using a commonly-logged HTTP header.
Re: Easy, realtime, system-wide Shellshock monitoring
#25Seems like an interesting article, however with the super thin font and the grey-text-on-grey-background it's just too hard to read.
The authors need a visit to http://contrastrebellion.com/
Re: Easy, realtime, system-wide Shellshock monitoring
#26I guess there are already worms around, exploiting this bug.
Thus, has somebody thought of exploiting and patching the attackers in response?
Re: Easy, realtime, system-wide Shellshock monitoring
#27Seems like an interesting article, however with the super thin font and the grey-text-on-grey-background it's just too hard to read. The authors need a visit to http://contrastrebellion.com/
Re: Easy, realtime, system-wide Shellshock monitoring
#28Earlier quoted context omitted.
Correct. It will log time, process name/pid, and what's going to be executed.
Why not actually also stop them?
I wouldn't use a program B to circumvent a bug of another program A if not in a exceptional case in which patch of program A cannot be created.
This is exactly the case. If bash has a bug. that must be fixed. And it has been done already. Just update bash in major distributions and the bug is gone.
But still you want to have a tool like sysdig to detect if your system has already been compromised previously and it is out of sysadmin control.
Re: Easy, realtime, system-wide Shellshock monitoring
#29Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)? Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.
Is this log public available ? I would like to dig into it.
Re: Easy, realtime, system-wide Shellshock monitoring
#30Earlier quoted context omitted.
Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.
Is this log public available ? I would like to dig into it.
This Google Doc has a list of URLs tested by the detectify.com scanner:
https://docs.google.com/document/d/1vN2QOG2OZIAHGXDmd5wB8FPi...