Easy, realtime, system-wide Shellshock monitoring • Hacker News Board

Re: Easy, realtime, system-wide Shellshock monitoring

#31

Post by daveloyall » Fri, Sep 26, 2014, 3:12 PM UTC

kaivi wrote: post #26

I guess there are already worms around, exploiting this bug. Thus, has somebody thought of exploiting and patching the attackers in response?

I haven't studied a worm in years, but historically it's been common practice to close the door you came in through upon entry, for exactly this reason.

Common, but by no means ubiquitous.

Re: Easy, realtime, system-wide Shellshock monitoring

#32

Post by tyleroderkirk » Sat, Sep 27, 2014, 1:16 PM UTC

nicklaforge wrote: post #21

shellshock_detector.lua seems to let this more obscure exploit slip by, undetected: http://seclists.org/oss-sec/2014/q3/696 http://seclists.org/oss-sec/2014/q3/734

that has now been fixed: https://github.com/draios/sysdig/pull/252

Re: Easy, realtime, system-wide Shellshock monitoring

#33

Post by PierreDow » Sat, Sep 27, 2014, 6:32 PM UTC

I'll give props to hackers clever enough to poke holes in a massive beast of a system that enjoys boasting itself as "impenetrable", but these, I'm not too happy about - http://www.pressreader.com/profile/Media_Mentions/shellshock. The potential effects are much too close for comfort.

Re: Easy, realtime, system-wide Shellshock monitoring

#34

Post by zobzu » Sat, Sep 27, 2014, 6:45 PM UTC

gighi wrote: post #6

zobzu wrote: post #2

well, installing a LKM, just that =p Now sysdig aint bad per se but id like to see it mainlined or using mainline code

Fair point, even though: - At this point sysdig is estimated to have tens of thousands of users, and we haven't gotten a kernel bug in a while, with people (us included) regularly using it a lot in production. Of course, I see the irony of mentioning this in a "shellshock" thread - the dkms packaging should completely hide all the complexities required in maintaining a kernel module - Part of the kernel code, if you…

its respectable but in the end it doesnt matter. when you have to run this on thousand of systems that have not been tested with that LKM, the LKM can potentially destroy everything.

its not like if grekh code was bug free - theres a lot of bugs being fixed daily in the kernel as well.

additionally, the kernel distribution path has better verifications than sysdig's and sorry, ill trust that more than a few guys. It doesnt make your work any less, its just the way it is.