Diagnosing & Treating Bash "Shellshock"

ByMike Moffit

OS X is a descendant of a long lineage of UNIX operating systems, from which it inherits its incredible stability and enhanced security. However, the past two weeks have uncovered numerous bugs in a core piece of software relied on by many UNIX operating systems, OS X included: bash (Bourne-again shell). It turns out that these bugs have been very long standing and can be exploited in numerous ways to provide unchecked access to a computer (in some cases remotely) with an afflicted version of bash installed. Due to the surprise and scope of this vulnerability, many have dubbed it “Shellshock”, in reference to the combat fatigue experienced by soldiers, but it’s really not a fair comparison to the effects of war.

A “shell” is a program that interprets and acts on textual commands either entered directly by a user at a terminal (or using a virtual terminal like the Terminal app found in /Applications/Utilities on OS X) or from a file containing one or more commands to be run automatically (sort of like a player piano, if that’s even a useful analogy anymore.) Bash is a very common shell program and is the default on many UNIX operating systems, including OS X (as of Mac OS X 10.3 Panther). If you’ve ever opened up the Terminal app and run a command in the last decade, you’ve used bash.

I personally write a fair number of scripts in the bash language to automate various processes on my computers and servers, primarily because it so ubiquitous. It may be partly because I’m a bit of a masochist, but—as a server admin—I also find it helps me perform tasks more efficiently when working in Terminal since it is the default. Needless to say I immediately started investigating the bugs, the attacks, and testing OS X workstations and servers.

Fortunately, without very specific custom configuration, OS X is not vulnerable to remote attacks through the afflicted version of bash, as echoed in the following statement from Apple (given to Jim Dalrymple of The Loop):

The vast majority of OS X users are not at risk to recently reported bash vulnerabilities. […] With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services.

None of the OS X 10.6 Snow Leopard through OS X 10.9 Mavericks systems I tested were vulnerable to remote attacks, however, all versions were susceptible to local attacks. The bugs are such that malicious commands can be inserted into “environment variables” (just what they sound like, data that exists in the environment in which individual shell scripts are run and therefore can be accessed by many scripts) and will be automatically executed upon any bash command or script being run. Not good. Since there are multiple bugs, there are different ways to test for each, but I find running the ‘bashcheck’ script to be very convenient way to test for all of them at once.

The bash developers and community have worked feverishly to investigate and fix these bugs. Apple has released “OS X bash Update 1.0” which includes fixes for the initial pair of bugs, but it unfortunately does not address subsequent bugs. As a further inconvenience, Apple does not provide this update via Software Update or the App Store, so you must download & install the appropriate update for your version of OS X:

OS X bash Update 1.0 – OS X Lion (10.7)
OS X bash Update 1.0 – OS X Mountain Lion (10.8)
OS X bash Update 1.0 – OS X Mavericks (10.9)

For those of you running Mac OS X 10.4 Tiger through 10.6 Snow Leopard on much older Macs, the developers of TenFourFox (an open-source version of the Firefox web browser specifically for older PPC & Intel Macs), provide a download along with detailed instructions to install a version of bash that fixes all the known vulnerabilities at this time. It does require command line experience, so is not for the faint of heart. The updated version provided by the TenFourFox team can also be used on OS X 10.7 Lion through 10.9 Mavericks and actually installs the very latest 4.3.x version of bash as opposed to the older 3.2.x version that Apple includes by default (and provided the partial fix for). This newer version of bash also has some benefits that programmers might enjoy, but it comes at the risk of possibly being downgraded by a future OS X update from Apple.

If you never use the Terminal app, I’d suggest you at least apply the appropriate version of “OS X bash Update 1.0” and any future updates that Apple might release to fix the additional vulnerabilities. For those of you who use Terminal with any frequency, you’ll want to proceed with caution and weigh the pros & cons of relying on Apple’s partial update or manually updating to the latest version of bash for your particular use.

Similar Posts

  • Zoom and Voiceover in iOS

    Working at the Service Check-in Counter, I often have customers asking me how to get out of Zoom and/or Voiceover on their iOS devices. While most people have Zoom and Voiceover disabled, it still shows up now and again.

    If you have used Zoom, the image to the right may seem familiar. If this happens, you can try to enter your passcode and navigate to Settings to turn off Zoom but this can be difficult. An easier way out is a simple 3 finger tap twice which will Zoom you back out.

    If you have seen the image above, then you also must have experienced Voiceover. Instead of using your finger to select individual apps, the screen is sectioned into rectangles, and you select that shape as whole. It is very hard to navigate, and the whole time a voice is instructing your movement. Voiceover is helpful for the visually impaired, but can be a hinderance if turned on. You must navigate back to Settings > Accessibility and turn Voiceover off if you do not wish to use it. If you have the shortcut enabled, you can try triple clicking the home button. This will turn off Voiceover. I would recommend turning off both Zoom and Voiceover, unless of course you need them and are familiar with their commands.

  • Cut Across Shorty, Cut Across

    Keyboard shortcuts are handy ways of using simple keyboard commands to handle tasks that might require multiple clicks of your mouse or trackpad. Sometimes using these shortcuts can save time and make your work flow easier. As an example, from time to time I grab screen shots to include in Kibbles or to send to customers. I can launch the Grab app to capture these screen shots but I can also hit ⇧⌘3 (shift/command/3) to capture the screen. Easier yet, if I frequently use that key combination I can customize the keys I use or make one of my function keys do the screen grab. Here’s how you would do that:

    # Choose System Preferences -> Keyboard->Shortcuts
    # You will see a bunch of shortcuts that are already there
    # Select Screen Shots
    # Pick the one you want – i.e. Save Picture of screen as a file and select it
    # Click on the existing key combination until it is highlighted
    # Enter your new key combination

    !{display: block;margin-left: auto;margin-right: auto;}http://blog.smalldog.com/images/4451.png!

    You will get a warning triangle if you choose a key combination (or function key) that is already in use.

    You can also add key combination shortcuts that are specific to an App. Selecting the App Shortcuts will take you there. Unless you have already set up some shortcuts, you will see only the key combination for “Show Help Menu” for all applications. To add a new shortcut to your favorite application you hit the + sign and a dialog box will pop up to allow you to select an app. From there you can set up the new shortcut:

    # Choose your App – or select all Apps if you want to set the key combination for the same menu command that appears in many Apps.
    # Type in the menu command for which you want to create a shortcut. VERY IMPORTANT – You must type the command exactly as it appears in the Application menu, including ellipses and any other punctuation. To type an ellipse, use three periods without spaces.
    # Click in the Keyboard Shortcut box and type the key combination or function key you wish to use and click “Add”.
    # Quit and restart any Apps that are open for the new keyboard command to take effect.

    !{display: block;margin-left: auto;margin-right: auto;}http://blog.smalldog.com/images/4452.png!

    If you assign a shortcut that already exists for another command or another App, your new shortcut will not work and you will have to find the menu command that is using that shortcut and change it.

  • New Year, New You

    …OK, so that’s a little hokey. I’m of the belief that a few resolutions are a good thing, but that they shouldn’t be…

  • More Thoughts on the Apple Event from the Small Dog Staff

    Erich Sullivan – South Burlington Service Writer

    The new Apple TV is what really has my attention, I’m already sold on the $200.00 64GB version.
    I don’t know what has me most sold, Siri? The App Store and what that will mean? I know that anything we’re thinking today will be dramatically upset with what will come from it. A simple unified search that lets me know if it’s in showtime, HBO, netflix or Hulu or in iTunes is going to be unreal. No more painfully typing in on that arcade style grid keyboard several times to find out no one has it. More time watching TV, less time struggling with an interface and search limitations.

    The App Store intends to turn the Apple TV into a casual gaming console, and the new remote gives it a change of being a decent experience.The new remote is exciting, the lightning connector for charging has me pondering things. They could have made it charge through micro USB, or run off batteries, or inductively charge on the top of the Apple TV box, but they went with lighting. It comes with the Lightning Cable to charge your remote, or your other Apple devices with a lightning port.

    Another interesting decision was the USB type C on the back of the new Apple TV for restores. Very forward thinking, and just another display that Apple is really pushing for USB type C to be the next ubiquitous connector.

    I have said many more things about the new Apple TV, but in short, I’m already sold.

    Morgan – Waitsfield IT

    I wasn’t all that thrilled about the  Watch additions (I’m still on the fence as to how useful I’d find the watch to be), but the iPad Pro announcement was cool. I know a lot of customers have been eagerly awaiting a larger iPad and—as a heavy iPad user myself—I know how useful they can be for work & play, so with iOS 9’s side-by-side apps support, it’ll be great. It’ll be especially useful for artists with the  Pencil (which itself is a great improvement since stylus support is pretty poor on the iPad) and may turn out to be a strong competitor to the expensive Wacom Cintiq line of drawing tablets with built-in displays. And, can I say one thing about the four speakers on the iPad Pro… FINALLY!

    The new  TV looks great & fun, but doesn’t seem entirely groundbreaking, just exactly what the next step of its evolution needed to be. That’s not to say I don’t want one, it definitely looks like a great product, just that it’s what I’d expect a new  TV to be. The remote looks very useful and fun for games, and I think that supporting iPhones & iPod touches as additional controllers is an absolutely brilliant idea.

    As usual, the iPhone 6S & 6S+ look like excellent upgrades to an already great phone. Bringing Force Touch to the iPhone will be a nice addition and I can’t help but geeking out about how they implemented it (Apple is really becoming quite ingenious on their technical solutions to difficult problems which actually make a bigger difference than most people think). And, they just keep making an excellent camera even better (the Live Photos are neat, esp. if they really don’t increase the photo size by much).

    Jim Overman – Waitsfield Phone Sales

    Siri On The Apple TV!

    There are many new exciting features to the Apple TV which make me think that it is time for an upgrade, but my favorite has to be the addition of Siri. In fact, the whole remote is pretty darn cool. It features a new glass touch surface remote that allows for easy maneuvering around the screen, just like an an iPhone or iPad. Back to Siri though, Siri is now able to do universal searches across iTunes, Netflix, Hulu and more for you favorite actor, director or genre. My very favorite part though is that if you ask Siri ‘What did they say?’, the Apple TV will automatically scroll back fifteen seconds and turn on closed captioning. I am particulary excited because when I watch Doctor Who I am doing this manually myself at least six or seven times per episode. No joke. It will be nice to just be able to ‘ask and receive’ as they say. The new Apple TV will actually come with two sizes of built-in storage, there will be a 32GB model for $149.99 and a 64GB for $199.99. Apple plans to start shipping in late October. I would say it is going to be on my holiday wish list but I am not sure I can I hold out that long!

    Joe Lytton – Key West Store Manager

    Just as we expected, Apple announced the next versions of its best-selling smartphones, the iPhone 6S and 6S Plus at its annual launch event in San Francisco. Also as we expected, the iPhone 6S looks identical to last year’s 4.7-inch iPhone 6S, reserving its most important changes for the hardware interior.
    True, there is a new color now, called rose gold (it basically looks like a blush pink, same as the new Apple Watch color option that the company announced). But as far as looks go, this extra shade is the extent of the the changes you’ll be able to visually detect between this year’s and last year’s phones.

    Apple says that its phone may look the same as last year’s model, but its iPhone 6S duo has achieved more inner strength. This time it uses a different grade of aluminum for its chassis, one that’s also used in the aerospace industry. They call it Series 7,000, and it’s the same aluminum alloy Apple puts into its Apple Watch Sport.
    A new type of chemically strengthened glass also tops the iPhone 6S, though the company hasn’t confirmed if this is cover material from Corning’s Gorilla Glass line or not.

    Apple has included a variation of Force Touch, which you find in different capacities on the Apple Watch and on some Mac trackpads. Called 3D Touch here, the iPhone 6S phones will adopt the same pressure-sensitive capability that calls up secondary menus and actions when you press and hold the screen. Press down and you can pull up context-sensitive menus, switch apps, or examine photos. But it’s a subtle riff on what already exists on iPhones: tapping and holding. Another use is to access shortcuts from the home screen for your most frequent actions, say messaging a friend. And if you’re in your email inbox, applying fingertip pressure to an element in the message will surface more information, like maybe the flight number on an emailed travel itinerary, for instance. (Apple called this concept “peeking in” during the live demo.) Pressing harder on an app will likewise generate more options, like viewing all the photos of a contact’s Instagram photo stream. In the context of a game, pressing harder could zoom you in to get closer to the action.

    A 12-megapixel camera is a huge jump for Apple, which has been holding onto its 8-megapixel sensors in its iPhone for years. Autofocus will pick up the pace, according to Apple, and color accuracy is a point of pride.

    The 5-megapixel front-facing camera now brings the iPhone 6S on par with a lot of today’s competing handsets. Of course, it includes the company’s proprietary voice chat feature, FaceTime video. Here’s something wildly different, though. Instead of including a dedicated flash for the front-facing camera, which only a few phones do, Apple is using the home screen to light up instead. This is meant to increase the brightness of those selfies even in low-light situations.

    A new feature you’ll see in the camera, Live Photos is a default mode that turns stills into a video or GIF, basically, images that move. It’s an automatic thing; all you have to do is take the picture like normal. When we took some shots, it seamlessly added Live Photo motion and sound. The Live Photo motion came out more like stop-motion or time lapse, however, than true video. It’s also important to note that one Live Photo is about twice the file size as a regular photo. Couple that with the 4K video capabilities (more on that later), and you’ll definitely need more storage space to accommodate.

    Apple also announced 4K video recording, at 3,840×2,160-pixel resolution. You’ll be able to take 8-megapixel camera photos while recording at this ultrahigh resolution. (The immediate benefit of shooting 4K video would be watching them later on a 4K TV.) Just like last year’s phones, the iPhone 6S Plus is the only model here with optical image stabilization, which helps correct blur from shaking hands.

    Under the hood, we have an upgraded, proprietary A9 processor that continues Apple’s theme of mystery when it comes to exactly what’s going on in there. Though it’s impossible to appreciate during our quick demo, what we do know is that this is Apple’s third-generation 64-bit chip. Apple claims that the A9 is 70 percent faster than last year’s A8 when it comes to the usual computing tasks (like opening an app, for example), and 90 percent faster at graphical tasks, like gaming.

    Apple says it’ll have the fastest forms of LTE Advanced, if that’s supported where you live, and will also include support for the latest, greatest Wi-Fi networks.

    The two new iPhones will run on iOS 9, mining all of those software enhancements, like a smarter Siri and up to three hours longer battery life, plus a new Low Power Mode. The updated operating system, which is currently in public beta, will arrive for phones on September 16.