Shellshocked: A Future Of 'Hair On Fire' Bugs

Network Computing Dark Reading

Advertise

About Us

Threaded | Newest First | Oldest First

[close this box]

Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 4:09:35 PM

hair-on-fire bug fatigue

Your point about this being another in a series of major flaws we'll face is so true, @Paul. What is worrisome is how this could spawn bug fatigue, almost like we're seeing in the wave of retail data breaches. Another day, another major Internet flaw is exposed. How does the industry avoid that?

rjones2818,
User Rank: Strategist
9/30/2014 | 11:03:40 AM

Re: hair-on-fire bug fatigue

Two things:

1) Simplify as much as possible, as has been mentioned in the comments. This is particularly true in the entrance to any programs. The fewer doors, the fewer ways for the rats to get in. I know it's a broad brush, but complexity for its own sake is unsafe. The likelyhood is that every system is probably unsafe due to designers not thinking of every way their code is going to be attacked. This isn't because they're bad designers, it's because not every way code is going to be attacked has been thought of by anybody yet.

2) The people who aren't patching aren't fatigued. Regular patchers shouldn't be fatigued, it's just part of what they do. People who patch absolutly everything the moment a patch comes out probably are fatigued.

Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 4:14:13 PM

Great analysis but is it really so hopeless?

It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on....

paulvixie,
User Rank: Author
9/26/2014 | 4:57:21 PM

Re: Great analysis but is it really so hopeless?

<< It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on.... >>

the situation at hand is the result of mass numbers of people acting in their short-term self interest, to the detriment of the whole, sort of in a "tragedy of the commons" remake. my comparison of this to global warming is not an accident. historically, the way we incentivize mass numbers of people to act in their longer-term self interest as opposed to their short-term self interest, has involved some combination of three things:

1. give them better choices (so, innovation)

2. increase the cost of some of their current choices (so, regulation)

3. make them better aware of their long-term self interest, and their choices (so, education)

one innovation i've been pondering for the last few years in the face of a similarly difficult problem which is the wide spread lack of source address validation at the edge of the internet, is a certification programme for devices which have been well tested under difficult conditions, along the lines of the "underwriters laboratory" sticker i looked for before buying a toaster oven for my kitchen.

but to your question ("what real work needs to be done?"), i think the first thing we've got to do is stop panicking every time one of these bugs comes along. we still have millions of devices vulnerable to attacks that had our hair on fire one, two, three, four, and five years ago -- clearly setting our hair on fire didn't have a big impact. so, do patch, but, also consider what i said on a private security forum yesterday:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

thank you for your question, it's an important one. --vix

aws0513,
User Rank: Ninja
9/29/2014 | 8:34:19 AM

Re: Great analysis but is it really so hopeless?

Great article Paul.

Since the announcement of the bug finding, I have not considered this a full on "sky is falling" situation. My reaction was more in line with my military background. It wasn't that we were not aware of the gravity of the situation, we just reacted as we always react to high risk vulnerability announcements. Business as usual for this IT security program.

First we went into full assessment mode to identify as many systems that could be affected as possible. This meant taking our inventory and removing the obvious non-players, actioning the known affected systems, and validation of the unknowns. We also ramped up monitoring practices for the time being until we feel most of the immediate risk has been mitigated.
We were fortunate in that we just finished implementing an inventory management practice that gives us a very comprehensive data set to start with. BTW... Inventory data on enterprise systems is probably the most powerful tool an IT security team can have. The classic "know thyself" factor. Having such a data set allows for efficient triage and planning. It is some overhead to keep an inventory current, but worth every penny when the sky does seem to be falling.

As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend. Now we are still sorting through and validating each unknown system/device to determine impact and remediation options. The fire fight is ongoing, but we have reinforced the weak points and are assessing the rest of the infrastructure to see if there are more.

paulvixie,
User Rank: Author
9/29/2014 | 9:06:35 AM

if you patched over the weekend, you're out of date, and vulnerable, again.

<< As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend. >>

if you patched over the weekend, you're out of date, and vulnerable, again. here's the latest as of this moment:

Shellshock (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277) is a vulnerability in GNU's bash shell that gives attackers access to run remote commands on a vulnerable system. If your system has not updated bash in since Sun Sep 28 2014: 1:11AM EST (See patch history), you're most definitely vulnerable and have been since first boot. This security vulnerability affects versions 1.14 (released in 1994) to the most recent version 4.3 according to NVD.

(that text is from https://shellshocker.net/)

Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:21:44 AM