Diagnosing & Treating Bash "Shellshock"

ByMike Moffit

OS X is a descendant of a long lineage of UNIX operating systems, from which it inherits its incredible stability and enhanced security. However, the past two weeks have uncovered numerous bugs in a core piece of software relied on by many UNIX operating systems, OS X included: bash (Bourne-again shell). It turns out that these bugs have been very long standing and can be exploited in numerous ways to provide unchecked access to a computer (in some cases remotely) with an afflicted version of bash installed. Due to the surprise and scope of this vulnerability, many have dubbed it “Shellshock”, in reference to the combat fatigue experienced by soldiers, but it’s really not a fair comparison to the effects of war.

A “shell” is a program that interprets and acts on textual commands either entered directly by a user at a terminal (or using a virtual terminal like the Terminal app found in /Applications/Utilities on OS X) or from a file containing one or more commands to be run automatically (sort of like a player piano, if that’s even a useful analogy anymore.) Bash is a very common shell program and is the default on many UNIX operating systems, including OS X (as of Mac OS X 10.3 Panther). If you’ve ever opened up the Terminal app and run a command in the last decade, you’ve used bash.

I personally write a fair number of scripts in the bash language to automate various processes on my computers and servers, primarily because it so ubiquitous. It may be partly because I’m a bit of a masochist, but—as a server admin—I also find it helps me perform tasks more efficiently when working in Terminal since it is the default. Needless to say I immediately started investigating the bugs, the attacks, and testing OS X workstations and servers.

Fortunately, without very specific custom configuration, OS X is not vulnerable to remote attacks through the afflicted version of bash, as echoed in the following statement from Apple (given to Jim Dalrymple of The Loop):

The vast majority of OS X users are not at risk to recently reported bash vulnerabilities. […] With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services.

None of the OS X 10.6 Snow Leopard through OS X 10.9 Mavericks systems I tested were vulnerable to remote attacks, however, all versions were susceptible to local attacks. The bugs are such that malicious commands can be inserted into “environment variables” (just what they sound like, data that exists in the environment in which individual shell scripts are run and therefore can be accessed by many scripts) and will be automatically executed upon any bash command or script being run. Not good. Since there are multiple bugs, there are different ways to test for each, but I find running the ‘bashcheck’ script to be very convenient way to test for all of them at once.

The bash developers and community have worked feverishly to investigate and fix these bugs. Apple has released “OS X bash Update 1.0” which includes fixes for the initial pair of bugs, but it unfortunately does not address subsequent bugs. As a further inconvenience, Apple does not provide this update via Software Update or the App Store, so you must download & install the appropriate update for your version of OS X:

OS X bash Update 1.0 – OS X Lion (10.7)
OS X bash Update 1.0 – OS X Mountain Lion (10.8)
OS X bash Update 1.0 – OS X Mavericks (10.9)

For those of you running Mac OS X 10.4 Tiger through 10.6 Snow Leopard on much older Macs, the developers of TenFourFox (an open-source version of the Firefox web browser specifically for older PPC & Intel Macs), provide a download along with detailed instructions to install a version of bash that fixes all the known vulnerabilities at this time. It does require command line experience, so is not for the faint of heart. The updated version provided by the TenFourFox team can also be used on OS X 10.7 Lion through 10.9 Mavericks and actually installs the very latest 4.3.x version of bash as opposed to the older 3.2.x version that Apple includes by default (and provided the partial fix for). This newer version of bash also has some benefits that programmers might enjoy, but it comes at the risk of possibly being downgraded by a future OS X update from Apple.

If you never use the Terminal app, I’d suggest you at least apply the appropriate version of “OS X bash Update 1.0” and any future updates that Apple might release to fix the additional vulnerabilities. For those of you who use Terminal with any frequency, you’ll want to proceed with caution and weigh the pros & cons of relying on Apple’s partial update or manually updating to the latest version of bash for your particular use.

Similar Posts

  • iVote. Do You?

    With three months to go until the presidential election, the two major candidates are doing everything they can to get the message out….

  • Seven Siri Tricks

    Siri is great for resolving trivia disputes, setting reminders and even texting or sending email but Siri is also a talented assistant. Here’s a few of the more non-intuitive tasks Siri can accomplish:

    1) Split up that restaurant bill and add a tip

    Ask Siri “What’s a 20% tip on a $105 bill split among 3 people and Siri will not only tell you what the total tip would be but also how much each of the 3 owes.

    2) Flip a coin

    Siri will bail you out if you do not have a coin to flip if you ask her to flip a coin. Or if you are killing time and want to play dice, ask Siri to “throw the dice”.

    3) Counting Calories

    Siri can help! Ask Siri how many calories are in that Big Mac and Siri will tell you that you are consuming 520 calories.

    4) Take a Selfie

    Ready to take that selfie and find yourself looking for the camera app? Just tell Siri to take a selfie and boom!, the camera app will open. Siri isn’t smart enough, yet, to ensure you have the front facing camera active so you might have to click that first.

    5) Name that Tune

    Siri integrates with Shazam to listen to the music. Ask Siri “What is this song?” and with some help from Shazam, Siri will let you know and if you click on the result it will play that song if you are a subscriber to Apple Music.

    6) Find your Friends

    If you use the Find My Friends app you can ask Siri to find them by asking “Where’s my wife?” and assuming that your wife has agreed to share her location in the Find My Friends app, Siri will let you know where she is.

    7) Convert Currency

    If you are traveling out of the country you can use Siri to make those currency conversions. Asking Siri “What is 100 euros worth?” today reveals it is worth $112.49.

  • Keychain Access, an Essential Tool

    I have been doing more onsite installations and lessons down here in Key West. So many times as I start to help a…

  • App Review: Tetris Blitz

    2014 marks the 30th anniversary of the most important technological development of all time: Tetris. There are probably many of you out there that will insist that the Macintosh computer was the most important tech release of 1984, and I will grant that it is a close second, but I am still standing behind the classic tile-matching puzzle video game.

    For those of you who don’t know, Tetris is a very simple game in which any of seven different blocks, which are every possible combination of four smaller square blocks that have adjoining sides, fall from above and your job is to move them side-to-side and/or rotate them in order to complete horizontal lines which disappear when completed. The ultimate move is to leave only one vertical line incomplete and drop the “line” piece in to complete four horizontal lines at once. This is a Tetris and you will be rewarded with big points, flashing graphics, sound effects, and the satisfaction of a job well done.

    Tetris was originally developed by Alexey Pajitnov in the Soviet Union, and was the first video game exported from the USSR to the US. Its popularity skyrocketed when a version was released for the Nintendo GameBoy in 1989, and versions have since been released for just about every console, operating system, personal electronic device, and has even been played by using the windows in a large building as the blocks.

    While the 8-bit NES version will always be my favorite, I have been playing a new version on my iPhone: “*Tetris Blitz by Electronic Arts.*”:https://itunes.apple.com/us/app/tetris-blitz/id632827808?mt=8&at=11lb7k This version takes the classic gameplay and condenses it into a two-minute speed round in which the goal is to score maximum points. They have added a number of power-up blocks which trigger different actions, such as lasers that burn up several lines for you or masses of blocks that drop all at once. You can play in single player mode, head-to-head against strangers or your Facebook friends, as well as in special tournaments which often have different rules or game mechanics for added variety. This app is free, but employs what has come to be known as the freemium model, which means that there are a fair number of in-app ads and in-app purchases that are available. If you can learn to ignore these, this app is a fun addition to the Tetris family and only -wastes- uses two minutes at a time.

    The best part? Tetris is good for you! According to research, playing half-an-hour a day for three months boosts general cognitive functions such as critical thinking, reasoning, language and processing and increases cerebral cortex thickness. It has also been shown to be a potential therapy for preventing PTSD as well as a way to help quit smoking. “*See here for more information.*”:http://en.wikipedia.org/wiki/Tetris#Effect_of_Tetris_on_the_brain

    “*Download Tetris Blitz for iOS FREE here!*”:https://itunes.apple.com/us/app/tetris-blitz/id632827808?mt=8&at=11lb7k

  • Cut Across Shorty, Cut Across

    Keyboard shortcuts are handy ways of using simple keyboard commands to handle tasks that might require multiple clicks of your mouse or trackpad. Sometimes using these shortcuts can save time and make your work flow easier. As an example, from time to time I grab screen shots to include in Kibbles or to send to customers. I can launch the Grab app to capture these screen shots but I can also hit ⇧⌘3 (shift/command/3) to capture the screen. Easier yet, if I frequently use that key combination I can customize the keys I use or make one of my function keys do the screen grab. Here’s how you would do that:

    # Choose System Preferences -> Keyboard->Shortcuts
    # You will see a bunch of shortcuts that are already there
    # Select Screen Shots
    # Pick the one you want – i.e. Save Picture of screen as a file and select it
    # Click on the existing key combination until it is highlighted
    # Enter your new key combination

    !{display: block;margin-left: auto;margin-right: auto;}http://blog.smalldog.com/images/4451.png!

    You will get a warning triangle if you choose a key combination (or function key) that is already in use.

    You can also add key combination shortcuts that are specific to an App. Selecting the App Shortcuts will take you there. Unless you have already set up some shortcuts, you will see only the key combination for “Show Help Menu” for all applications. To add a new shortcut to your favorite application you hit the + sign and a dialog box will pop up to allow you to select an app. From there you can set up the new shortcut:

    # Choose your App – or select all Apps if you want to set the key combination for the same menu command that appears in many Apps.
    # Type in the menu command for which you want to create a shortcut. VERY IMPORTANT – You must type the command exactly as it appears in the Application menu, including ellipses and any other punctuation. To type an ellipse, use three periods without spaces.
    # Click in the Keyboard Shortcut box and type the key combination or function key you wish to use and click “Add”.
    # Quit and restart any Apps that are open for the new keyboard command to take effect.

    !{display: block;margin-left: auto;margin-right: auto;}http://blog.smalldog.com/images/4452.png!

    If you assign a shortcut that already exists for another command or another App, your new shortcut will not work and you will have to find the menu command that is using that shortcut and change it.