Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Shellshocked: A Future Of Hair On Fire Bugs
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:37:59 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
Thank you, @Paul. This is good to know. 
paulvixie
50%
50%
paulvixie,
User Rank: Author
9/29/2014 | 9:32:04 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
<< So @Paul, how would orgs who patched over the weekend actually know that their patch has to be redone? Is US-CERT or ICS-CERT planning to issue an alert to let them know? There's so much information flying around, it must be a nightmare to stay on top of this.  >>

i recommend looking at the shellshocked.net web site, writing down the list of CVE's, and then looking at your vendor's patch literature, and making sure that every CVE listed at the shellshocked.net web site, is listed as fixed by some recent patch from your vendor.

if not, call your vendor.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/29/2014 | 9:21:44 AM
Re: if you patched over the weekend, you're out of date, and vulnerable, again.
So @Paul, how would orgs who patched over the weekend actually know that their patch has to be redone? Is US-CERT or ICS-CERT planning to issue an alert to let them know? There's so much information flying around, it must be a nightmare to stay on top of this. 
paulvixie
50%
50%
paulvixie,
User Rank: Author
9/29/2014 | 9:06:35 AM
if you patched over the weekend, you're out of date, and vulnerable, again.
<< As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend. >>

if you patched over the weekend, you're out of date, and vulnerable, again. here's the latest as of this moment:

Shellshock (CVE-2014-6271CVE-2014-7169CVE-2014-7186CVE-2014-7187CVE-2014-6277) is a vulnerability in GNU's bash shell that gives attackers access to run remote commands on a vulnerable system. If your system has not updated bash in since Sun Sep 28 2014: 1:11AM EST (See patch history), you're most definitely vulnerable and have been since first boot. This security vulnerability affects versions 1.14 (released in 1994) to the most recent version 4.3 according to NVD.

(that text is from https://shellshocker.net/)

aws0513
50%
50%
aws0513,
User Rank: Ninja
9/29/2014 | 8:34:19 AM
Re: Great analysis but is it really so hopeless?
Great article Paul.

Since the announcement of the bug finding, I have not considered this a full on "sky is falling" situation.  My reaction was more in line with my military background. It wasn't that we were not aware of the gravity of the situation, we just reacted as we always react to high risk vulnerability announcements.  Business as usual for this IT security program.

First we went into full assessment mode to identify as many systems that could be affected as possible.  This meant taking our inventory and removing the obvious non-players, actioning the known affected systems, and validation of the unknowns.  We also ramped up monitoring practices for the time being until we feel most of the immediate risk has been mitigated.
We were fortunate in that we just finished implementing an inventory management practice that gives us a very comprehensive data set to start with.  BTW...  Inventory data on enterprise systems is probably the most powerful tool an IT security team can have.  The classic "know thyself" factor.  Having such a data set allows for efficient triage and planning.  It is some overhead to keep an inventory current, but worth every penny when the sky does seem to be falling.

As it stands today, we are looking good on the patching front thanks to some dedicated work over the weekend.  Now we are still sorting through and validating each unknown system/device to determine impact and remediation options.  The fire fight is ongoing, but we have reinforced the weak points and are assessing the rest of the infrastructure to see if there are more.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 8:08:13 AM
Re: Ok, so now what?
Thanks for these links, Paul, not to mention your spot-on advice for dealing with Shellshock, both long- and short-term. Hope you'll keep us apprised of new insights/developoments as this story continues to unfold. 
paulvixie
50%
50%
paulvixie,
User Rank: Author
9/26/2014 | 6:44:22 PM
Re: Ok, so now what?
<< Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves? >>

my recommendation is as follows:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

i hope this helps. --vix

kstaron
50%
50%
kstaron,
User Rank: Apprentice
9/26/2014 | 6:36:25 PM
Ok, so now what?
Okay ,so it's out there, other than patching what can we do about it? It's not feasible to throw all the devices out and start fresh, so where does that leave us? As consumers what can we do to protect ourselves?
paulvixie
50%
50%
paulvixie,
User Rank: Author
9/26/2014 | 4:57:21 PM
Re: Great analysis but is it really so hopeless?
<< It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on....  >>

the situation at hand is the result of mass numbers of people acting in their short-term self interest, to the detriment of the whole, sort of in a "tragedy of the commons" remake. my comparison of this to global warming is not an accident. historically, the way we incentivize mass numbers of people to act in their longer-term self interest as opposed to their short-term self interest, has involved some combination of three things:

1. give them better choices (so, innovation)

2. increase the cost of some of their current choices (so, regulation)

3. make them better aware of their long-term self interest, and their choices (so, education)

one innovation i've been pondering for the last few years in the face of a similarly difficult problem which is the wide spread lack of source address validation at the edge of the internet, is a certification programme for devices which have been well tested under difficult conditions, along the lines of the "underwriters laboratory" sticker i looked for before buying a toaster oven for my kitchen.

but to your question ("what real work needs to be done?"), i think the first thing we've got to do is stop panicking every time one of these bugs comes along. we still have millions of devices vulnerable to attacks that had our hair on fire one, two, three, four, and five years ago -- clearly setting our hair on fire didn't have a big impact. so, do patch, but, also consider what i said on a private security forum yesterday:

correct reaction would be strategic: get an inventory of the contents of every smart device your agency or your company owns or operates or depends upon, and enact a phase-out plan that replaces every non-upgradeable or un-auditable device with something you can actually control. let normal apple/redhat/$vendor upgrade/patch take care of their products on your network in due course. note for example that the first patch released by redhat yesterday did not go far enough to fix this bug.

thank you for your question, it's an important one. --vix

<<   <   Page 2 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...