Diagnosing & Treating Bash "Shellshock"

OS X is a descendant of a long lineage of UNIX operating systems, from which it inherits its incredible stability and enhanced security. However, the past two weeks have uncovered numerous bugs in a core piece of software relied on by many UNIX operating systems, OS X included: bash (Bourne-again shell). It turns out that these bugs have been very long standing and can be exploited in numerous ways to provide unchecked access to a computer (in some cases remotely) with an afflicted version of bash installed. Due to the surprise and scope of this vulnerability, many have dubbed it “Shellshock”, in reference to the combat fatigue experienced by soldiers, but it’s really not a fair comparison to the effects of war.

A “shell” is a program that interprets and acts on textual commands either entered directly by a user at a terminal (or using a virtual terminal like the Terminal app found in /Applications/Utilities on OS X) or from a file containing one or more commands to be run automatically (sort of like a player piano, if that’s even a useful analogy anymore.) Bash is a very common shell program and is the default on many UNIX operating systems, including OS X (as of Mac OS X 10.3 Panther). If you’ve ever opened up the Terminal app and run a command in the last decade, you’ve used bash.

I personally write a fair number of scripts in the bash language to automate various processes on my computers and servers, primarily because it so ubiquitous. It may be partly because I’m a bit of a masochist, but—as a server admin—I also find it helps me perform tasks more efficiently when working in Terminal since it is the default. Needless to say I immediately started investigating the bugs, the attacks, and testing OS X workstations and servers.

Fortunately, without very specific custom configuration, OS X is not vulnerable to remote attacks through the afflicted version of bash, as echoed in the following statement from Apple (given to Jim Dalrymple of The Loop):

The vast majority of OS X users are not at risk to recently reported bash vulnerabilities. […] With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services.

None of the OS X 10.6 Snow Leopard through OS X 10.9 Mavericks systems I tested were vulnerable to remote attacks, however, all versions were susceptible to local attacks. The bugs are such that malicious commands can be inserted into “environment variables” (just what they sound like, data that exists in the environment in which individual shell scripts are run and therefore can be accessed by many scripts) and will be automatically executed upon any bash command or script being run. Not good. Since there are multiple bugs, there are different ways to test for each, but I find running the ‘bashcheck’ script to be very convenient way to test for all of them at once.

The bash developers and community have worked feverishly to investigate and fix these bugs. Apple has released “OS X bash Update 1.0” which includes fixes for the initial pair of bugs, but it unfortunately does not address subsequent bugs. As a further inconvenience, Apple does not provide this update via Software Update or the App Store, so you must download & install the appropriate update for your version of OS X:

OS X bash Update 1.0 – OS X Lion (10.7)
OS X bash Update 1.0 – OS X Mountain Lion (10.8)
OS X bash Update 1.0 – OS X Mavericks (10.9)

For those of you running Mac OS X 10.4 Tiger through 10.6 Snow Leopard on much older Macs, the developers of TenFourFox (an open-source version of the Firefox web browser specifically for older PPC & Intel Macs), provide a download along with detailed instructions to install a version of bash that fixes all the known vulnerabilities at this time. It does require command line experience, so is not for the faint of heart. The updated version provided by the TenFourFox team can also be used on OS X 10.7 Lion through 10.9 Mavericks and actually installs the very latest 4.3.x version of bash as opposed to the older 3.2.x version that Apple includes by default (and provided the partial fix for). This newer version of bash also has some benefits that programmers might enjoy, but it comes at the risk of possibly being downgraded by a future OS X update from Apple.

If you never use the Terminal app, I’d suggest you at least apply the appropriate version of “OS X bash Update 1.0” and any future updates that Apple might release to fix the additional vulnerabilities. For those of you who use Terminal with any frequency, you’ll want to proceed with caution and weigh the pros & cons of relying on Apple’s partial update or manually updating to the latest version of bash for your particular use.

Similar Posts

  • Bouncing Lions

    I love Lion. So far it is my favorite iteration of Mac OS X, but it does have some annoying features. In my internet wanderings yesterday I came across an article with instructions on how to get rid of the rubber-band effect which occurs when you scroll to the very bottom or top of a page. This effect will make the page scroll a little bit past the end point then bounce back. It’s a nice little bit of eye-candy, but not really necessary.

    You can easily turn this effect off by entering a simple Terminal command (which I’ll list below) and then press “enter”. As always, do this at your own risk. Mucking about in Terminal can cause irreparable harm to your OS if you do something you shouldn’t. Make sure you have a good backup before you make any changes like this to your system. Here’s the text you need to enter:

    defaults write -g NSScrollViewRubberbanding -int 0

    You can revert to the original setting by entering the following and then press enter:

    defaults delete -g NSScrollViewRubberbanding

    You’ll need to relaunch any applications that display the rubber-banding in order for this to take effect. Unfortunately, it will not affect Safari. Should I find a way to get rid of the rubber-band in Safari, I’ll update this article.

    You can read the original article here.

  • Migrate Your Data to a New Mac

    When a customer buys a new Mac, there’s often a question of what to do about the old data. All that old data is all that stuff that made your old machine yours: it’s the settings, the pictures, saved web page bookmarks, documents, spreadsheets…all that stuff.

    Frequently a Mac-to-Mac data transfer can be done without any special equipment or advanced knowledge. The easiest way is to use Apple’s Migration Assistant which is a program built into OS X, and is on every new Mac. When setting up a new Mac (or any Mac that’s been reset to factory settings, generally from the disk being wiped and the OS being reinstalled) it’ll prompt you to make a decision.

    The top option is to transfer data from a start up disk or Time Machine backup. If you’re already doing a Time Machine backup to an external HDD this is the best option, just make sure your backup is completely up to date. If it’s behind, any changes you’ve made won’t show up on your new machine when the transfer completes. Once you’ve identified the drive you want the data to come from it goes through and calculates the sizes of everything on that older drive. You’ve got a little control of what comes over, like whether or not you want the entire Applications folder, but nothing more specific than that. It’ll also tell you how much available space will be left over, or if there’s more data on the source drive than the destination.

    I recommend using a Time Machine backup drive (any external HDD that has a Time Machine backup on it) because it’ll be useful for backups on the new machine. It’ll even see that it’s a new machine that has all the same data and ask if you want to keep using the same Time Machine backup; this is call inheriting.

    Alternatively, you can put the source machine into Target Disk Mode by pressing the T key when the machine is booting and having it connected to the destination machine through Thunderbolt or FireWire. Target disk mode only works through Thunderbolt and FireWire, don’t bother trying anything else. I’ve wasted enough time for us all: it’s not supported. If you’re transferring data from a machine with FireWire but no Thunderbolt to a new Mac that only has Thunderbolt you can get a Thunderbolt to Firewire adapter, but that’ll run you $30 and you might not have another use for it after the data migration. You could also use a Thunderbolt cable, but that’ll also run you at least $30, and again, you might not have another use for it, that’s why I recommend an external HDD. If you’re not doing a backup, it’s worth the peace of mind, and simplifies data transfers.

  • Hulu Plus Now Available On Apple TV

    There has been a lot of talk about the Apple TV recently thanks to the addition of AirPlay Mirroring functionality to Mountain Lion….

  • Fody Personal Weather Station: A Review

    When I saw that we had started to carry the Fody Tempus Pro Bluetooth weather station, I was immediately interested. At my apartment, I had a really old, pretty cheap, wireless thermometer I was using to help me figure out how to dress myself for the conditions outside. You know, t-shirt, sweater, jacket, full Antarctica-grade parka…it is Vermont after all. The problem I always had with it was that the remote sensor couldn’t get wet, and there just weren’t many places I could put it. Last year I got a slightly better thermometer base station that used a wired thermocouple that could easily be passed out a closed window. The thermocouple is sealed and can get as wet as you want. That worked a lot better, but the base station features weren’t as good. I didn’t like the way it recorded min/max temperature.

    So when I saw the Tempus Pro, I thought it might be able to solve all of my problems. In addition to indoor/outdoor temperature and indoor humidity, it also records outdoor humidity, rainfall, barometric pressure, windspeed and wind direction. Instead of all that data going to a limited base station, it goes to my iPad, where I can quickly see trends, share it with friends on Twitter or Facebook or just email myself the raw data.

    I had a few concerns such as whether or not the radiation shield on the outdoor temperature sensor would work. You have to install the Tempus Pro in an open location so that wind and rain can be recorded, but this most likely means it’ll be in the sun too, which would completely mess up the temperature reading. The radiation shield actually does an amazing job at preventing that. I haven’t seen any excessively high temperatures recorded even when the station was baking in the sun.

    Setup was very easy for a device that’s actually doing a lot of complicated things. The outdoor station transmits its data to the indoor base station that is plugged into the wall for power. This transmission is probably very basic radio since the range is quite a bit more than is possible with Bluetooth and the outdoor station only uses three included AA batteries. The indoor station uses low-energy Bluetooth to relay indoor and outdoor sensor data with your iOS or Android device.

    Once everything is paired and running (which is easy to do if you follow the order indicated by the instructions), you will see real-time data being displayed on your iOS or Android device via the Fody app. It also builds graphs of historical data so you can watch trends. One of the things I liked most about the app was the alerts feature. I can set high/low alert thresholds for any of the sensors. I set up an alert for when the outdoor temperature falls below freezing. A few times this past week, I was sitting on my couch and heard my iPad chime. It was an alert letting me know it had fallen below freezing outside. Very cool! You could also set other useful alerts for things like excessive rain, or high winds.

    Overall I think the Tempus Pro is a pretty neat device and the simple use and setup belies the actual complexity of having your own personal weather station. If you’ve ever been curious about setting up a personal weather station at home, or just want something a bit more than temperature readings like I did, you won’t be disappointed with the Fody Tempus Pro.

  • App Review: Tetris Blitz

    2014 marks the 30th anniversary of the most important technological development of all time: Tetris. There are probably many of you out there that will insist that the Macintosh computer was the most important tech release of 1984, and I will grant that it is a close second, but I am still standing behind the classic tile-matching puzzle video game.

    For those of you who don’t know, Tetris is a very simple game in which any of seven different blocks, which are every possible combination of four smaller square blocks that have adjoining sides, fall from above and your job is to move them side-to-side and/or rotate them in order to complete horizontal lines which disappear when completed. The ultimate move is to leave only one vertical line incomplete and drop the “line” piece in to complete four horizontal lines at once. This is a Tetris and you will be rewarded with big points, flashing graphics, sound effects, and the satisfaction of a job well done.

    Tetris was originally developed by Alexey Pajitnov in the Soviet Union, and was the first video game exported from the USSR to the US. Its popularity skyrocketed when a version was released for the Nintendo GameBoy in 1989, and versions have since been released for just about every console, operating system, personal electronic device, and has even been played by using the windows in a large building as the blocks.

    While the 8-bit NES version will always be my favorite, I have been playing a new version on my iPhone: “*Tetris Blitz by Electronic Arts.*”:https://itunes.apple.com/us/app/tetris-blitz/id632827808?mt=8&at=11lb7k This version takes the classic gameplay and condenses it into a two-minute speed round in which the goal is to score maximum points. They have added a number of power-up blocks which trigger different actions, such as lasers that burn up several lines for you or masses of blocks that drop all at once. You can play in single player mode, head-to-head against strangers or your Facebook friends, as well as in special tournaments which often have different rules or game mechanics for added variety. This app is free, but employs what has come to be known as the freemium model, which means that there are a fair number of in-app ads and in-app purchases that are available. If you can learn to ignore these, this app is a fun addition to the Tetris family and only -wastes- uses two minutes at a time.

    The best part? Tetris is good for you! According to research, playing half-an-hour a day for three months boosts general cognitive functions such as critical thinking, reasoning, language and processing and increases cerebral cortex thickness. It has also been shown to be a potential therapy for preventing PTSD as well as a way to help quit smoking. “*See here for more information.*”:http://en.wikipedia.org/wiki/Tetris#Effect_of_Tetris_on_the_brain

    “*Download Tetris Blitz for iOS FREE here!*”:https://itunes.apple.com/us/app/tetris-blitz/id632827808?mt=8&at=11lb7k

  • Create an AirPlay Speaker

    Apple’s AirPlay is one of the best technologies out there for media lovers. AirPlay allows you to control/play your favorite media to devices…