Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Shellshocked: A Future Of Hair On Fire Bugs
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:37:59 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
Thank you, @Paul. This is good to know. 
paulvixie
paulvixie,
User Rank: Author
9/29/2014 | 9:32:04 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
<< So @Paul, how would orgs who patched over the weekend actually know that their patch has to be redone? Is US-CERT or ICS-CERT planning to issue an alert to let them know? There's so much information flying around, it must be a nightmare to stay on top of this.  >>

i recommend looking at the shellshocked.net web site, writing down the list of CVE's, and then looking at your vendor's patch literature, and making sure that every CVE listed at the shellshocked.net web site, is listed as fixed by some recent patch from your vendor.

if not, call your vendor.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:21:44 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
So @Paul, how would orgs who patched over the weekend actually know that their patch has to be redone? Is US-CERT or ICS-CERT planning to issue an alert to let them know? There's so much information flying around, it must be a nightmare to stay on top of this. 
paulvixie
paulvixie,
User Rank: Author
9/29/2014 | 9:06:35 AM
if you patched over the weekend, you're out of date, and vulnerable, again.
<< As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend. >>

if you patched over the weekend, you're out of date, and vulnerable, again. here's the latest as of this moment:

Shellshock (CVE-2014-6271CVE-2014-7169CVE-2014-7186CVE-2014-7187CVE-2014-6277) is a vulnerability in GNU's bash shell that gives attackers access to run remote commands on a vulnerable system. If your system has not updated bash in since Sun Sep 28 2014: 1:11AM EST (See patch history), you're most definitely vulnerable and have been since first boot. This security vulnerability affects versions 1.14 (released in 1994) to the most recent version 4.3 according to NVD.

(that text is from https://shellshocker.net/)

aws0513
aws0513,
User Rank: Ninja
9/29/2014 | 8:34:19 AM
Re: Great analysis but is it really so hopeless?
Great article Paul.

Since the announcement of the bug finding, I have not considered this a full on "sky is falling" situation.  My reaction was more in line with my military background. It wasn't that we were not aware of the gravity of the situation, we just reacted as we always react to high risk vulnerability announcements.  Business as usual for this IT security program.

First we went into full assessment mode to identify as many systems that could be affected as possible.  This meant taking our inventory and removing the obvious non-players, actioning the known affected systems, and validation of the unknowns.  We also ramped up monitoring practices for the time being until we feel most of the immediate risk has been mitigated.
We were fortunate in that we just finished implementing an inventory management practice that gives us a very comprehensive data set to start with.  BTW...  Inventory data on enterprise systems is probably the most powerful tool an IT security team can have.  The classic "know thyself" factor.  Having such a data set allows for efficient triage and planning.  It is some overhead to keep an inventory current, but worth every penny when the sky does seem to be falling.

As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend.  Now we are still sorting through and validating each unknown system/device to determine impact and remediation options.  The fire fight is ongoing, but we have reinforced the weak points and are assessing the rest of the infrastructure to see if there are more.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 8:08:13 AM
Re: Ok, so now what?
Thanks for these links, Paul, not to mention your spot-on advice for dealing with Shellshock, both long- and short-term. Hope you'll keep us apprised of new insights/developoments as this story continues to unfold. 
paulvixie
paulvixie,
User Rank: Author
9/26/2014 | 6:44:22 PM
Re: Ok, so now what?
<< Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves? >>

my recommendation is as follows:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

i hope this helps. --vix

kstaron
kstaron,
User Rank: Apprentice
9/26/2014 | 6:36:25 PM
Ok, so now what?
Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves?
paulvixie
paulvixie,
User Rank: Author
9/26/2014 | 4:57:21 PM
Re: Great analysis but is it really so hopeless?
<< It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on....  >>

the situation at hand is the result of mass numbers of people acting in their short-term self interest, to the detriment of the whole, sort of in a "tragedy of the commons" remake. my comparison of this to global warming is not an accident. historically, the way we incentivize mass numbers of people to act in their longer-term self interest as opposed to their short-term self interest, has involved some combination of three things:

1. give them better choices (so, innovation)

2. increase the cost of some of their current choices (so, regulation)

3. make them better aware of their long-term self interest, and their choices (so, education)

one innovation i've been pondering for the last few years in the face of a similarly difficult problem which is the wide spread lack of source address validation at the edge of the internet, is a certification programme for devices which have been well tested under difficult conditions, along the lines of the "underwriters laboratory" sticker i looked for before buying a toaster oven for my kitchen.

but to your question ("what real work needs to be done?"), i think the first thing we've got to do is stop panicking every time one of these bugs comes along. we still have millions of devices vulnerable to attacks that had our hair on fire one, two, three, four, and five years ago -- clearly setting our hair on fire didn't have a big impact. so, do patch, but, also consider what i said on a private security forum yesterday:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

thank you for your question, it's an important one. --vix

<<   <   Page 2 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-12508
PUBLISHED: 2023-02-06
A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The n...
CVE-2014-12508
PUBLISHED: 2023-02-06
A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2. Affected is an unknown function of the file trigger_ratethread.php. The manipulation of the argument t/postusername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The name of the p...
CVE-2017-20175
PUBLISHED: 2023-02-05
A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...
CVE-2022-45786
PUBLISHED: 2023-02-04
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 &amp; AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition ...
CVE-2023-22849
PUBLISHED: 2023-02-04
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling Ap...