Shellshock: "Bug" threatens the security of hundreds of millions of computers

Shellshock: A few months after the discovery of the now infamous Heartbleed, a new "bug" (problem software) φαίνεται να θέτει σε κίνδυνο την ασφάλεια εκατοντάδων εκατομμυρίων computers, servers και συσκευών.

According to a BBC report, the problem was detected in a software section called Bash, which is found on many Linux systems, as well as on Apple's Mac operating system. The bug, which was "baptized" by Shellshock, may, according to researchers, be used to remotely control each system used by Bash - and some find it more dangerous than heartbleed.

"While something like it heartbleed has to do with the monitoring of what's going on, this has to do with gaining immediate access to the system, "he said. with the BBC Professor Alan Woodward, a security researcher University of Surrey.

As noted in the report, Early calculations (which are even considered by some experts as conservative), Shellshock could affect at least 500 million machines. The importance of the issue is best understood by taking into account that many web servers "run" the Apache system, which contains Bash (Bourne-Again Shell).

In a statement US-CERT (US Computer Emergency Readiness Team) reports that it is aware of a vulnerability in Bash that affects "Unix-based operating systems such as Linux and Mac OS X. Exploiting this vulnerability can allow someone who attacks remotely to execute arbitrary code on an affected system. It is recommended for users and administrators to see the Redhat Security Blog for further details and contact the service providers Linux or Unix-based functionality for an analog Patch. A GNU Bash patch is also available for application by experienced users and administrators. Functional updates include: CentOS, Debian, Redhat, Ubuntu.

However, according to the BBC, some researchers warn that the patches are incomplete and will not have a full effect protection των συστημάτων. Αξίζει να σημειωθεί ότι η εκμετάλλευση του bug για διεξαγωγή attacks χαρακτηρίζεται ως ιδιαίτερα απλή. Όπως αναφέρεται σε δημοσίευμα του Guardian, o Νταν Γκουΐντο, διευθύνων σύμβουλος της εταιρείας κυβερνοασφαλείας Trail of Bits επισημαίνει ότι  «η μέθοδος εκμετάλλευσης είναι πολύ πιο απλή (σε σχέση με το Heartbleed). Απλά κάνετε cut και paste μια line code, and you get good results."

Source: naftemporiki.gr