A new threat for Linux-based machines jumped into public attention earlier this week with a threat that could end up being worse than the Heartbleed scare. The security vulnerability, which has gained the moniker “Bash Bug”, or “Shellshock” affects the shell commands of Linux-based computers, servers and even Macs.
Systems use Bash to execute “shell” commands; basically, this means that it translates user commands into something an operating system can understand. What the vulnerability does is allow an attacker to add malicious code into the shell command. Where Heartbleed allowed an attacker to spy on users, the Bash Bug allows hackers to access confidential information directly or even take direct control of a system. What makes matters worse is that where Heartbleed took a high degree of precision to exploit, the Bash Bug can be taken advantage of with only a basic understanding of the vulnerability.
Security experts have rated the Bash Bug vulnerability with the highest severity rating and rated it “low” for complexity of exploitation. The United States Computer Emergency Readiness Team, or US-CERT, has already issued a recommendation that all Linux administrators seek operating system patches immediately. Unfortunately, some security experts have already warned that the best patches available are “incomplete” and would not fully secure systems. Regardless, admins should apply the latest patches from Red Hat and wait for a more permanent solution.
The Bash security bug is not something to take lightly, not only could it open your systems to threats now but there is no telling what hidden malware could be left behind by a clever attacker. This is a security flaw that could follow system admins for years; patch your systems immediately and keep a lookout for news from your Linux distributers as the situation develops.
– Richard Keene
IT Computer Support of New York
Webmaster and Lead Designer