Shellshock Vulnerability
Over the past year many new security scares have popped up causing IT departments all over the world to scramble to protect their most vital data. One of the more recent ones, discovered in mid-September called Shellshock actually affected all machines that run the Unix shell Bash. Bash is the software behind the text-based utility called Terminal on Mac OS X systems. It gives the user access to all services that the computer has to offer and is also used on most Linux systems. It can be installed on Windows but doesn’t come standard, and requires a little bit of effort to get it to work on a Windows based system. Within hours of the discovery and announcement of the vulnerability, hackers took advantage and began creating extensive networks of vulnerable computers called Botnets, that when given a command from the controller can do just about anything without the owner/user of the infected computer knowing what was happening.
This vulnerability within Bash allows commands to be run as administrator when the command is inside another command as a variable. It gets complicated but essentially if you have a long command that doesn’t require root access, there is a way to embed another command within that first and the embedded command will run with root access without having to input the root/administrator password. This sort of vulnerability is a major flaw and allows complete access to a system to install or use whatever resources are connected to the vulnerable machine without the need to authenticate as an administrator.
Since the discovery, a method has also been discovered to determine if your machine has the flawed Bash version. Open Terminal (it’s in /Applications/Utilities or use Spotlight to find it) then copy and paste this command and press enter:
@env x='() { :;}; echo vulnerable’ bash -c “echo this is a test”@
If your system contains the vulnerability it will output two lines: one says “vulnerable” and the second line says “this is a test”. If you don’t have the vulnerability then all it will say is “this is a test”.
Make sure your computer is up to date. There are websites out there that will allow you to download a patch to fix the vulnerability. If you want to do it yourself rather than wait for a fix to come through your software updates, make sure you trust the source you’re downloading from. Who knows what else you’re installing into your machine when you try to patch it yourself.
“*See this article from our Director of IT & Development Morgan Aldridge for some further advice on patching this vulnerability.*”:http://blog.smalldog.com/article/diagnosing-treating-bash-shellshock/
I’m a big advocate of knowing how to protect yourself, be it your identity, your data, or your privacy. Shellshock is a backdoor to your computer and your digital life. Whatever you do make sure you are taking the most precautions possible. Use two-factor authentication on all of your internet accounts when its available. Never use the same password twice. Use encryption on your personal computer and your external hard drives. Encrypt your cell phone backups. Don’t share personal information when you don’t have too. If someone with malicious intent is interested in getting into your life, don’t make it easy for them!
