Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Shellshocked: A Future Of Hair On Fire Bugs
Oldest First  |  Newest First  |  Threaded View
Page 1 / 3   >   >>
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 4:09:35 PM
hair-on-fire bug fatigue
Your point about this being another in a series of major flaws we'll face is so true, @Paul. What is worrisome is how this could spawn bug fatigue, almost like we're seeing in the wave of retail data breaches. Another day, another major Internet flaw is exposed. How does the industry avoid that?
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 4:14:13 PM
Great analysis but is it really so hopeless?
It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on.... 
paulvixie
paulvixie,
User Rank: Author
9/26/2014 | 4:57:21 PM
Re: Great analysis but is it really so hopeless?
<< It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on....  >>

the situation at hand is the result of mass numbers of people acting in their short-term self interest, to the detriment of the whole, sort of in a "tragedy of the commons" remake. my comparison of this to global warming is not an accident. historically, the way we incentivize mass numbers of people to act in their longer-term self interest as opposed to their short-term self interest, has involved some combination of three things:

1. give them better choices (so, innovation)

2. increase the cost of some of their current choices (so, regulation)

3. make them better aware of their long-term self interest, and their choices (so, education)

one innovation i've been pondering for the last few years in the face of a similarly difficult problem which is the wide spread lack of source address validation at the edge of the internet, is a certification programme for devices which have been well tested under difficult conditions, along the lines of the "underwriters laboratory" sticker i looked for before buying a toaster oven for my kitchen.

but to your question ("what real work needs to be done?"), i think the first thing we've got to do is stop panicking every time one of these bugs comes along. we still have millions of devices vulnerable to attacks that had our hair on fire one, two, three, four, and five years ago -- clearly setting our hair on fire didn't have a big impact. so, do patch, but, also consider what i said on a private security forum yesterday:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

thank you for your question, it's an important one. --vix

kstaron
kstaron,
User Rank: Apprentice
9/26/2014 | 6:36:25 PM
Ok, so now what?
Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves?
paulvixie
paulvixie,
User Rank: Author
9/26/2014 | 6:44:22 PM
Re: Ok, so now what?
<< Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves? >>

my recommendation is as follows:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

i hope this helps. --vix

Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 8:08:13 AM
Re: Ok, so now what?
Thanks for these links, Paul, not to mention your spot-on advice for dealing with Shellshock, both long- and short-term. Hope you'll keep us apprised of new insights/developoments as this story continues to unfold. 
aws0513
aws0513,
User Rank: Ninja
9/29/2014 | 8:34:19 AM
Re: Great analysis but is it really so hopeless?
Great article Paul.

Since the announcement of the bug finding, I have not considered this a full on "sky is falling" situation.  My reaction was more in line with my military background. It wasn't that we were not aware of the gravity of the situation, we just reacted as we always react to high risk vulnerability announcements.  Business as usual for this IT security program.

First we went into full assessment mode to identify as many systems that could be affected as possible.  This meant taking our inventory and removing the obvious non-players, actioning the known affected systems, and validation of the unknowns.  We also ramped up monitoring practices for the time being until we feel most of the immediate risk has been mitigated.
We were fortunate in that we just finished implementing an inventory management practice that gives us a very comprehensive data set to start with.  BTW...  Inventory data on enterprise systems is probably the most powerful tool an IT security team can have.  The classic "know thyself" factor.  Having such a data set allows for efficient triage and planning.  It is some overhead to keep an inventory current, but worth every penny when the sky does seem to be falling.

As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend.  Now we are still sorting through and validating each unknown system/device to determine impact and remediation options.  The fire fight is ongoing, but we have reinforced the weak points and are assessing the rest of the infrastructure to see if there are more.
paulvixie
paulvixie,
User Rank: Author
9/29/2014 | 9:06:35 AM
if you patched over the weekend, you're out of date, and vulnerable, again.
<< As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend. >>

if you patched over the weekend, you're out of date, and vulnerable, again. here's the latest as of this moment:

Shellshock (CVE-2014-6271CVE-2014-7169CVE-2014-7186CVE-2014-7187CVE-2014-6277) is a vulnerability in GNU's bash shell that gives attackers access to run remote commands on a vulnerable system. If your system has not updated bash in since Sun Sep 28 2014: 1:11AM EST (See patch history), you're most definitely vulnerable and have been since first boot. This security vulnerability affects versions 1.14 (released in 1994) to the most recent version 4.3 according to NVD.

(that text is from https://shellshocker.net/)

Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:21:44 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
So @Paul, how would orgs who patched over the weekend actually know that their patch has to be redone? Is US-CERT or ICS-CERT planning to issue an alert to let them know? There's so much information flying around, it must be a nightmare to stay on top of this. 
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-41604
PUBLISHED: 2022-09-27
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows creation of a junction directory. This ca...
CVE-2022-40199
PUBLISHED: 2022-09-27
Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.
CVE-2022-40352
PUBLISHED: 2022-09-27
Online Tours &amp; Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
CVE-2022-40353
PUBLISHED: 2022-09-27
Online Tours &amp; Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.
CVE-2022-40354
PUBLISHED: 2022-09-27
Online Tours &amp; Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.