Diagnosing & Treating Bash "Shellshock"

OS X is a descendant of a long lineage of UNIX operating systems, from which it inherits its incredible stability and enhanced security. However, the past two weeks have uncovered numerous bugs in a core piece of software relied on by many UNIX operating systems, OS X included: bash (Bourne-again shell). It turns out that these bugs have been very long standing and can be exploited in numerous ways to provide unchecked access to a computer (in some cases remotely) with an afflicted version of bash installed. Due to the surprise and scope of this vulnerability, many have dubbed it “Shellshock”, in reference to the combat fatigue experienced by soldiers, but it’s really not a fair comparison to the effects of war.

A “shell” is a program that interprets and acts on textual commands either entered directly by a user at a terminal (or using a virtual terminal like the Terminal app found in /Applications/Utilities on OS X) or from a file containing one or more commands to be run automatically (sort of like a player piano, if that’s even a useful analogy anymore.) Bash is a very common shell program and is the default on many UNIX operating systems, including OS X (as of Mac OS X 10.3 Panther). If you’ve ever opened up the Terminal app and run a command in the last decade, you’ve used bash.

I personally write a fair number of scripts in the bash language to automate various processes on my computers and servers, primarily because it so ubiquitous. It may be partly because I’m a bit of a masochist, but—as a server admin—I also find it helps me perform tasks more efficiently when working in Terminal since it is the default. Needless to say I immediately started investigating the bugs, the attacks, and testing OS X workstations and servers.

Fortunately, without very specific custom configuration, OS X is not vulnerable to remote attacks through the afflicted version of bash, as echoed in the following statement from Apple (given to Jim Dalrymple of The Loop):

The vast majority of OS X users are not at risk to recently reported bash vulnerabilities. […] With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services.

None of the OS X 10.6 Snow Leopard through OS X 10.9 Mavericks systems I tested were vulnerable to remote attacks, however, all versions were susceptible to local attacks. The bugs are such that malicious commands can be inserted into “environment variables” (just what they sound like, data that exists in the environment in which individual shell scripts are run and therefore can be accessed by many scripts) and will be automatically executed upon any bash command or script being run. Not good. Since there are multiple bugs, there are different ways to test for each, but I find running the ‘bashcheck’ script to be very convenient way to test for all of them at once.

The bash developers and community have worked feverishly to investigate and fix these bugs. Apple has released “OS X bash Update 1.0” which includes fixes for the initial pair of bugs, but it unfortunately does not address subsequent bugs. As a further inconvenience, Apple does not provide this update via Software Update or the App Store, so you must download & install the appropriate update for your version of OS X:

OS X bash Update 1.0 – OS X Lion (10.7)
OS X bash Update 1.0 – OS X Mountain Lion (10.8)
OS X bash Update 1.0 – OS X Mavericks (10.9)

For those of you running Mac OS X 10.4 Tiger through 10.6 Snow Leopard on much older Macs, the developers of TenFourFox (an open-source version of the Firefox web browser specifically for older PPC & Intel Macs), provide a download along with detailed instructions to install a version of bash that fixes all the known vulnerabilities at this time. It does require command line experience, so is not for the faint of heart. The updated version provided by the TenFourFox team can also be used on OS X 10.7 Lion through 10.9 Mavericks and actually installs the very latest 4.3.x version of bash as opposed to the older 3.2.x version that Apple includes by default (and provided the partial fix for). This newer version of bash also has some benefits that programmers might enjoy, but it comes at the risk of possibly being downgraded by a future OS X update from Apple.

If you never use the Terminal app, I’d suggest you at least apply the appropriate version of “OS X bash Update 1.0” and any future updates that Apple might release to fix the additional vulnerabilities. For those of you who use Terminal with any frequency, you’ll want to proceed with caution and weigh the pros & cons of relying on Apple’s partial update or manually updating to the latest version of bash for your particular use.

Similar Posts

  • More Thoughts on the Apple Event from the Small Dog Staff

    Erich Sullivan – South Burlington Service Writer

    The new Apple TV is what really has my attention, I’m already sold on the $200.00 64GB version.
    I don’t know what has me most sold, Siri? The App Store and what that will mean? I know that anything we’re thinking today will be dramatically upset with what will come from it. A simple unified search that lets me know if it’s in showtime, HBO, netflix or Hulu or in iTunes is going to be unreal. No more painfully typing in on that arcade style grid keyboard several times to find out no one has it. More time watching TV, less time struggling with an interface and search limitations.

    The App Store intends to turn the Apple TV into a casual gaming console, and the new remote gives it a change of being a decent experience.The new remote is exciting, the lightning connector for charging has me pondering things. They could have made it charge through micro USB, or run off batteries, or inductively charge on the top of the Apple TV box, but they went with lighting. It comes with the Lightning Cable to charge your remote, or your other Apple devices with a lightning port.

    Another interesting decision was the USB type C on the back of the new Apple TV for restores. Very forward thinking, and just another display that Apple is really pushing for USB type C to be the next ubiquitous connector.

    I have said many more things about the new Apple TV, but in short, I’m already sold.

    Morgan – Waitsfield IT

    I wasn’t all that thrilled about the  Watch additions (I’m still on the fence as to how useful I’d find the watch to be), but the iPad Pro announcement was cool. I know a lot of customers have been eagerly awaiting a larger iPad and—as a heavy iPad user myself—I know how useful they can be for work & play, so with iOS 9’s side-by-side apps support, it’ll be great. It’ll be especially useful for artists with the  Pencil (which itself is a great improvement since stylus support is pretty poor on the iPad) and may turn out to be a strong competitor to the expensive Wacom Cintiq line of drawing tablets with built-in displays. And, can I say one thing about the four speakers on the iPad Pro… FINALLY!

    The new  TV looks great & fun, but doesn’t seem entirely groundbreaking, just exactly what the next step of its evolution needed to be. That’s not to say I don’t want one, it definitely looks like a great product, just that it’s what I’d expect a new  TV to be. The remote looks very useful and fun for games, and I think that supporting iPhones & iPod touches as additional controllers is an absolutely brilliant idea.

    As usual, the iPhone 6S & 6S+ look like excellent upgrades to an already great phone. Bringing Force Touch to the iPhone will be a nice addition and I can’t help but geeking out about how they implemented it (Apple is really becoming quite ingenious on their technical solutions to difficult problems which actually make a bigger difference than most people think). And, they just keep making an excellent camera even better (the Live Photos are neat, esp. if they really don’t increase the photo size by much).

    Jim Overman – Waitsfield Phone Sales

    Siri On The Apple TV!

    There are many new exciting features to the Apple TV which make me think that it is time for an upgrade, but my favorite has to be the addition of Siri. In fact, the whole remote is pretty darn cool. It features a new glass touch surface remote that allows for easy maneuvering around the screen, just like an an iPhone or iPad. Back to Siri though, Siri is now able to do universal searches across iTunes, Netflix, Hulu and more for you favorite actor, director or genre. My very favorite part though is that if you ask Siri ‘What did they say?’, the Apple TV will automatically scroll back fifteen seconds and turn on closed captioning. I am particulary excited because when I watch Doctor Who I am doing this manually myself at least six or seven times per episode. No joke. It will be nice to just be able to ‘ask and receive’ as they say. The new Apple TV will actually come with two sizes of built-in storage, there will be a 32GB model for $149.99 and a 64GB for $199.99. Apple plans to start shipping in late October. I would say it is going to be on my holiday wish list but I am not sure I can I hold out that long!

    Joe Lytton – Key West Store Manager

    Just as we expected, Apple announced the next versions of its best-selling smartphones, the iPhone 6S and 6S Plus at its annual launch event in San Francisco. Also as we expected, the iPhone 6S looks identical to last year’s 4.7-inch iPhone 6S, reserving its most important changes for the hardware interior.
    True, there is a new color now, called rose gold (it basically looks like a blush pink, same as the new Apple Watch color option that the company announced). But as far as looks go, this extra shade is the extent of the the changes you’ll be able to visually detect between this year’s and last year’s phones.

    Apple says that its phone may look the same as last year’s model, but its iPhone 6S duo has achieved more inner strength. This time it uses a different grade of aluminum for its chassis, one that’s also used in the aerospace industry. They call it Series 7,000, and it’s the same aluminum alloy Apple puts into its Apple Watch Sport.
    A new type of chemically strengthened glass also tops the iPhone 6S, though the company hasn’t confirmed if this is cover material from Corning’s Gorilla Glass line or not.

    Apple has included a variation of Force Touch, which you find in different capacities on the Apple Watch and on some Mac trackpads. Called 3D Touch here, the iPhone 6S phones will adopt the same pressure-sensitive capability that calls up secondary menus and actions when you press and hold the screen. Press down and you can pull up context-sensitive menus, switch apps, or examine photos. But it’s a subtle riff on what already exists on iPhones: tapping and holding. Another use is to access shortcuts from the home screen for your most frequent actions, say messaging a friend. And if you’re in your email inbox, applying fingertip pressure to an element in the message will surface more information, like maybe the flight number on an emailed travel itinerary, for instance. (Apple called this concept “peeking in” during the live demo.) Pressing harder on an app will likewise generate more options, like viewing all the photos of a contact’s Instagram photo stream. In the context of a game, pressing harder could zoom you in to get closer to the action.

    A 12-megapixel camera is a huge jump for Apple, which has been holding onto its 8-megapixel sensors in its iPhone for years. Autofocus will pick up the pace, according to Apple, and color accuracy is a point of pride.

    The 5-megapixel front-facing camera now brings the iPhone 6S on par with a lot of today’s competing handsets. Of course, it includes the company’s proprietary voice chat feature, FaceTime video. Here’s something wildly different, though. Instead of including a dedicated flash for the front-facing camera, which only a few phones do, Apple is using the home screen to light up instead. This is meant to increase the brightness of those selfies even in low-light situations.

    A new feature you’ll see in the camera, Live Photos is a default mode that turns stills into a video or GIF, basically, images that move. It’s an automatic thing; all you have to do is take the picture like normal. When we took some shots, it seamlessly added Live Photo motion and sound. The Live Photo motion came out more like stop-motion or time lapse, however, than true video. It’s also important to note that one Live Photo is about twice the file size as a regular photo. Couple that with the 4K video capabilities (more on that later), and you’ll definitely need more storage space to accommodate.

    Apple also announced 4K video recording, at 3,840×2,160-pixel resolution. You’ll be able to take 8-megapixel camera photos while recording at this ultrahigh resolution. (The immediate benefit of shooting 4K video would be watching them later on a 4K TV.) Just like last year’s phones, the iPhone 6S Plus is the only model here with optical image stabilization, which helps correct blur from shaking hands.

    Under the hood, we have an upgraded, proprietary A9 processor that continues Apple’s theme of mystery when it comes to exactly what’s going on in there. Though it’s impossible to appreciate during our quick demo, what we do know is that this is Apple’s third-generation 64-bit chip. Apple claims that the A9 is 70 percent faster than last year’s A8 when it comes to the usual computing tasks (like opening an app, for example), and 90 percent faster at graphical tasks, like gaming.

    Apple says it’ll have the fastest forms of LTE Advanced, if that’s supported where you live, and will also include support for the latest, greatest Wi-Fi networks.

    The two new iPhones will run on iOS 9, mining all of those software enhancements, like a smarter Siri and up to three hours longer battery life, plus a new Low Power Mode. The updated operating system, which is currently in public beta, will arrive for phones on September 16.

  • Electronic Signing Made Easy

    I was at a customer’s office the other day helping to set up their new Mac system. It was a busy construction company and they needed help getting wireless scanning operational. I noticed that they were using Adobe Reader for their PDF files, so I introduced them to “*Preview*”:https://support.apple.com/en-us/HT201740. Once I set the Finder to open PDF files with Preview instead of Reader, I showed them how to access the scanner to scan documents right from Preview.

    As I had them practice this, I noticed that much of their scanning needs were for documents that they would print out, sign, scan and then email to clients. When I showed them how to use the “signature” function in Preview they immediately saw the value and time saved. So, I know many of you already know how to use this tool, but I thought I would go over it so you too can use your electronic signature.

    Preview is used to view and edit PDFs and images, import images from a camera, import documents and images from a scanner, add pages to a PDF and also to take screen shots. When you have a PDF that needs your signature, the old way of doing this would be to print out the PDF, sign it, scan it and send it back. With Preview you can skip some of that work. You can capture your signature using your trackpad or better yet, using your camera on your Mac.

    ! Annotate > Signature > Manage Signatures*. When you select *Create Signature* you have a choice of trackpad or camera. While signing on your trackpad is okay, I prefer the camera method. Here you take a white piece of paper and sign it. Then click on *Camera* as the means of capturing your signature and hold up that piece of paper to the camera on your Mac. Once you align the signature on the blue line you can hit *Done* and your signature is stored. If you don’t like the first try, click *Clear* and do over.

    To add your signature to a PDF document click on the *Sign* button !http://blog.smalldog.com/images/4295.png! or use the path *Tools > Annotate > Signature* to select the signature. Once it has been placed on the document you can drag it to where you want it, then use the handles to adjust its size. Save the document and you can include it in an email with your signature. Remember that the *Save As* command is sort of hidden now but to get to it simply hold down the *Option key* when you select *File.*

  • Fody Personal Weather Station: A Review

    When I saw that we had started to carry the Fody Tempus Pro Bluetooth weather station, I was immediately interested. At my apartment, I had a really old, pretty cheap, wireless thermometer I was using to help me figure out how to dress myself for the conditions outside. You know, t-shirt, sweater, jacket, full Antarctica-grade parka…it is Vermont after all. The problem I always had with it was that the remote sensor couldn’t get wet, and there just weren’t many places I could put it. Last year I got a slightly better thermometer base station that used a wired thermocouple that could easily be passed out a closed window. The thermocouple is sealed and can get as wet as you want. That worked a lot better, but the base station features weren’t as good. I didn’t like the way it recorded min/max temperature.

    So when I saw the Tempus Pro, I thought it might be able to solve all of my problems. In addition to indoor/outdoor temperature and indoor humidity, it also records outdoor humidity, rainfall, barometric pressure, windspeed and wind direction. Instead of all that data going to a limited base station, it goes to my iPad, where I can quickly see trends, share it with friends on Twitter or Facebook or just email myself the raw data.

    I had a few concerns such as whether or not the radiation shield on the outdoor temperature sensor would work. You have to install the Tempus Pro in an open location so that wind and rain can be recorded, but this most likely means it’ll be in the sun too, which would completely mess up the temperature reading. The radiation shield actually does an amazing job at preventing that. I haven’t seen any excessively high temperatures recorded even when the station was baking in the sun.

    Setup was very easy for a device that’s actually doing a lot of complicated things. The outdoor station transmits its data to the indoor base station that is plugged into the wall for power. This transmission is probably very basic radio since the range is quite a bit more than is possible with Bluetooth and the outdoor station only uses three included AA batteries. The indoor station uses low-energy Bluetooth to relay indoor and outdoor sensor data with your iOS or Android device.

    Once everything is paired and running (which is easy to do if you follow the order indicated by the instructions), you will see real-time data being displayed on your iOS or Android device via the Fody app. It also builds graphs of historical data so you can watch trends. One of the things I liked most about the app was the alerts feature. I can set high/low alert thresholds for any of the sensors. I set up an alert for when the outdoor temperature falls below freezing. A few times this past week, I was sitting on my couch and heard my iPad chime. It was an alert letting me know it had fallen below freezing outside. Very cool! You could also set other useful alerts for things like excessive rain, or high winds.

    Overall I think the Tempus Pro is a pretty neat device and the simple use and setup belies the actual complexity of having your own personal weather station. If you’ve ever been curious about setting up a personal weather station at home, or just want something a bit more than temperature readings like I did, you won’t be disappointed with the Fody Tempus Pro.

  • Go Wireless!

    I am a huge fan of wireless technology. I have been slowly updating my home office to be as wireless as I can with speakers from Sonos and all of my computer accessories from my keyboard to printer are wireless as well. One area that I had not ventured into yet has been wireless headphones. I am often working at home, and because my office space is part of my main living space, I often have to have headphones while working. It was only recently that I started to use wireless headphones and frankly I can’t believe I hadn’t started to use this technology sooner! Urbanears has a bluetooth option in their popular Plattan line up, the Plattan ADV. I was able to easily link the headphones to my computer and no longer felt tethered to my desk when working. With the bluetooth headphones I could easily leave my desk for a glass of water or to let dogs out without missing a beat. The battery easily lasts all day and unlike some other bluetooth headphones, you can easily plug them into your computer or device directly with a cable should you forget to charge them. I also linked up these headphones to one of my iPads. These headphones allow you to have them linked with up to 8 devices, so you can easily use them from one device to the next without having to pair and unpair constantly.

    Over the ear headphones are great for around the home and office, but not the most practical when you’re exercising. As mentioned a few weeks ago I have begun trying to get out and move more in recent weeks, and carrying my iPhone in my hand or pocket when out for a run was becoming a bit of an annoyance. The Ourdoor Tech Orcas are the perfect solution. With the bluetooth on my Apple Watch I easily paired these headphones with my watch, synced a playlist to my watch and left my phone behind! The headphones are lightweight and comfortable. I am not a fan of in ear headphones and I was skeptical that these headphones would work well for me, but I was pleasantly surprised by how well they stayed in my ears and with the quality of the sound. Many in ear headphones begin to wiggle out of your ears or provide sub par sound quality, but these headphones have truly made me change the way I think of in-ear headphones. As an added bonus they also feature a built in microphone. This feature isn’t something that I can say I have taken advantage of, but it’s certainly nice to know I could take a call if I needed to.

  • Migrate Your Data to a New Mac

    When a customer buys a new Mac, there’s often a question of what to do about the old data. All that old data is all that stuff that made your old machine yours: it’s the settings, the pictures, saved web page bookmarks, documents, spreadsheets…all that stuff.

    Frequently a Mac-to-Mac data transfer can be done without any special equipment or advanced knowledge. The easiest way is to use Apple’s Migration Assistant which is a program built into OS X, and is on every new Mac. When setting up a new Mac (or any Mac that’s been reset to factory settings, generally from the disk being wiped and the OS being reinstalled) it’ll prompt you to make a decision.

    The top option is to transfer data from a start up disk or Time Machine backup. If you’re already doing a Time Machine backup to an external HDD this is the best option, just make sure your backup is completely up to date. If it’s behind, any changes you’ve made won’t show up on your new machine when the transfer completes. Once you’ve identified the drive you want the data to come from it goes through and calculates the sizes of everything on that older drive. You’ve got a little control of what comes over, like whether or not you want the entire Applications folder, but nothing more specific than that. It’ll also tell you how much available space will be left over, or if there’s more data on the source drive than the destination.

    I recommend using a Time Machine backup drive (any external HDD that has a Time Machine backup on it) because it’ll be useful for backups on the new machine. It’ll even see that it’s a new machine that has all the same data and ask if you want to keep using the same Time Machine backup; this is call inheriting.

    Alternatively, you can put the source machine into Target Disk Mode by pressing the T key when the machine is booting and having it connected to the destination machine through Thunderbolt or FireWire. Target disk mode only works through Thunderbolt and FireWire, don’t bother trying anything else. I’ve wasted enough time for us all: it’s not supported. If you’re transferring data from a machine with FireWire but no Thunderbolt to a new Mac that only has Thunderbolt you can get a Thunderbolt to Firewire adapter, but that’ll run you $30 and you might not have another use for it after the data migration. You could also use a Thunderbolt cable, but that’ll also run you at least $30, and again, you might not have another use for it, that’s why I recommend an external HDD. If you’re not doing a backup, it’s worth the peace of mind, and simplifies data transfers.