BASH : Deadly Serious Bug Bigger than 'Heart bleed' bug

[Tech_Dreamer]

 "The Door's Wide Open.."

 

 

 

A "deadly serious" bug potentially affecting hundreds of millions of computers, servers and devices has been discovered. With this flaw, criminals can potentially break computers or steal private and government information.

 

More than 500 million computers could be affected, early estimates suggest,  According to open source software company Red Hat it affects any device that uses the operating system Linux ,which includes everything from calculators to cars. But it also affects Apple Macs and some Android, Windows and IBM machines

 

 

"The bug, dubbed Shellshock, can be used to remotely take control of almost any system using Bash.. Whereas something like Heartbleed was all about sniffing what was going on, this was about giving you direct access to the system"

 

 

The problem extends to lots of Internet-connected computers located anywhere -- from shops to hospitals to schools.

 

     The flaw has been found in a software component known as Bash, Bash : AKA Bourne-Again SHell , Which is a part of many Linux systems as well as Apple's Mac operating system. it is a command prompt on many Unix computers. Unix is an operating system on which many others are built, such as Linux and Mac OS. Experts said it was more serious than the Heatbleed Bug

 

The bug was discovered by Stephane Chazelas, a French IT manager working for a software maker in Scotland.

 

 

Here's How the Bug Works..  (Robert Graham)

 

The problem stems from a flaw in the "bash," a type of computer program called a shell. A shell translates commands from you to a device's operating system. Think of it as an efficient middleman. Lots of Internet connected devices use the bash shell to run commands, like "turn on" and "turn off." Generally, a device that communicates using a bash shell also looks for extra information, like what browser or device you're using.

And that's where the problem lies. If a hacker slips bad code into this extra data, they can sneak past a device's safeguards.

 

Even a simple element such as a "smart" Internet-connected lightbulb then suddenly becomes a launchpad to hack everything else behind your network firewall, That could be your home computer, or a retailer's payment terminals, or a government office's sensitive database of information.

 

 

 

 

"Whereas something like Heartbleed was all about sniffing what was going on, this was about giving you direct access to the system,"

                                                                                                                    -  Prof Alan Woodward

 

 

Some 500,000 machines worldwide were thought to have been vulnerable to Heartbleed. But early estimates, which experts said were conservative, suggest that Shellshock could hit at least 500 million machines.

 

The problem is particularly serious given that many web servers are run using the Apache system, software which includes the Bash component.The US Computer Emergency Readiness Team (US-Cert) issued a warning about the bug,Urging system administrators to start patching.

 

However, other security researchers warned that the patches were "incomplete" and would not fully secure systems. Of particular concern to security experts is the simplicity of carrying out attacks that make use of the bug. Cybersecurity specialists Rapid7 rated the Bash bug as 10 out of 10 for severity, but "low" on complexity - a relatively easy vulnerability for hackers to capitalise on.

 

 

"Using this vulnerability, attackers can potentially take over the operating system, access confidential information, make changes, et cetera," said Tod Beardsley, a Rapid7 engineer.

"Anybody with systems using Bash needs to deploy the patch immediately."

 

 

 

 

For general home users, Prof Woodward suggested simply keeping an eye on manufacturer websites for updates - particularly for hardware such as broadband routers.

 

 

Link : (News Courtesy -BBC , CNN news)

 

https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability

http://www.bbc.com/news/technology-29361794

http://money.cnn.com/2014/09/24/technology/security/bash-bug/index.html

 

 

 

That's shit load of mess , Post your comments & thoughts down below..

[Real_PhillBert]

So.. On a scale from 1 to 10, how worried should I be?

[AMICLG]

Repost:http://linustechtips.com/main/topic/221885-very-compromising-bug-found-in-bash-utility/ and It was patched on 99% of Linux systems if you update so OS X is probably the only one really effected.

[TJ_Hack3r]

This is the fourth post on BASH I've seen

[Syntaxvgm]

Repost. With the sensationalist headline I predicted. 

[Tech_Dreamer]

Repost:http://linustechtips.com/main/topic/221885-very-compromising-bug-found-in-bash-utility/ and It was patched on 99% of Linux systems if you update so OS X is probably the only one really effected.

 

 

This is the fourth post on BASH I've seen

 

 

Repost. With the sensationalist headline I predicted. 

 

 

Reported , The thread will be removed soon, Thanks for the heads up peeps,

[brownninja97]

Repost. With the sensationalist headline I predicted. 

be glad i didnt make a thread on this then lol, you guys know how wild mine are