Just so I understand fully, this doesn't block attempts, just logs them?
Correct. It will log time, process name/pid, and what's going to be executed.
Easy, realtime, system-wide Shellshock monitoring
11–20 of 34 posts
Re: Easy, realtime, system-wide Shellshock monitoring
#12Re: Easy, realtime, system-wide Shellshock monitoring
#13This looks cool but I can't get it running on Ubuntu 14.04. I just installed sysdig but I don't have the shellshock_detect chisel :/ Is it available yet through apt?
What do you get if you run "sysdig --version"? If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig . What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-…
Why is the Ubuntu package version behind the upstream version?
Re: Easy, realtime, system-wide Shellshock monitoring
#14Earlier quoted context omitted.
What do you get if you run "sysdig --version"? If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig . What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-…
Why is the Ubuntu package version behind the upstream version?
We just released 0.1.89 (special release to include the shellshock chisel) a few hours ago, so distribution maintainers aren't that fast: https://github.com/draios/sysdig/releases
Debian is currently at 0.1.88: https://packages.debian.org/sid/sysdig
And Ubuntu periodically merges all the unstable packages from Debian, so that's why they're lagging one version behind at this moment.
Re: Easy, realtime, system-wide Shellshock monitoring
#15Earlier quoted context omitted.
version on brew is 0.1.88. What's the best way for mac users to get this?
Yeah, bummer, I can submit a PR to Homebrew but it would take a few hours/days, and we don't ship OSX binaries from Draios, so why don't you go with: https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-... Assuming you have a C/C++ compiler installed (comes via XCode) it really takes like 2 minutes. Lazy alternative, in a couple days maximum Homebrew should be updated, unfortunately it doesn't depend on us. A…
If you publish the updated brew, can't it manually be added by users?
Re: Easy, realtime, system-wide Shellshock monitoring
#16Earlier quoted context omitted.
Yeah, bummer, I can submit a PR to Homebrew but it would take a few hours/days, and we don't ship OSX binaries from Draios, so why don't you go with: https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-... Assuming you have a C/C++ compiler installed (comes via XCode) it really takes like 2 minutes. Lazy alternative, in a couple days maximum Homebrew should be updated, unfortunately it doesn't depend on us. A…
If you publish the updated brew, can't it manually be added by users?
Yes, we most definitely can publish a private brew tap. I'm no expert as I mainly use Linux, but my understanding is that I'd need to create a brand new draios/homebrew-sysdig repo. I'll try to find the time to look into this and update the documentation. If, instead, just a PR to our main repo would suffice, feel free to send it over and we'll merge it in no time :)
Re: Easy, realtime, system-wide Shellshock monitoring
#17Earlier quoted context omitted.
Correct. It will log time, process name/pid, and what's going to be executed.
Why would you prefer this over the LD_PRELOAD workaround provided by redhat?
The LD_PRELOAD workaround is meant to "fix" the shellshock bug, sysdig doesn't do that, it just passively monitors every injection attempt up to the point where the injected function is actually read by a newly spawn bash.
With the LD_PRELOAD trick you can definitely secure your system, but you won't be able to see if there's a new service that is being used as an attack vector (for your own curiosity). With sysdig, you can, and if you capture a trace file you can also follow the exact process chain that caused the propagation of the environment variable.
Re: Easy, realtime, system-wide Shellshock monitoring
#18Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)?
Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
Re: Easy, realtime, system-wide Shellshock monitoring
#19Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)? Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.