Story image

First we had heartbleed, now we're shellshocked

01 Oct 14

Security companies are continuing to warn businesses to ensure they have patches in place across all vulnerable systems, following the discovery of yet another security bug, this time dubbed Shellshocked.

The vulnerability was discovered last week and affects systems running several versions of Linux and Unix operating systems, including Mac OS X, and some routers and internet of things devices.

As Shellshock is related to Linux it can affect both PC and Apple platform.

Trend Micro says the vulnerability – also known as the Bash Bug because it is a bug in the Unix Bash shell – is a ‘potentially plague-like’ vulnerability that can exploit command access to Linux-based systems constituting around 51% of web servers worldwide.

“Because of the pervasiveness, attacks against it could grow at a very fast pace.

“The recent Heartbleed vulnerability is similar in nature to Shellshock, but Heartbleed is dwarfed by the extent and reach of this new vulnerability.”

Reports quickly emerged of Shellshock related attacks internationally, with attacks leveraging the Bash bug vulnerability ranging from botnet attacks to IRC bots.

Trend Micro’s Geoff Prentis says there hasn't been much nefarious scanning for vulnerable systems across Australia and New Zealand, and little disclosure as yet of any malicious attacks.

However, he warns companies still need to be wary and ensure patching across all Internet facing servers.

Website operators are also warned to patch asap if Bash is in the script, or rescript away from Bash.

Prentis says there is ‘huge exposure’ for cloud, however he says ‘a lot’ of cloud providers moved ‘extremely quickly’ to protect themselves from the exploit.

He says it is key for any systems in the cloud to make sure they have protection such as an Intrusion Prevention System running inside their cloud environment, and that patches are quickly updated.

Because patching takes time, he suggest network forensics also be put to use.

Symantec said last week that the vulnerability could allow attackers to not only gain control over a targeted computer if exploited successfully, but could also provide them with access to other computers on the affected network.

Patches have been steadily released since the discover of the vulnerability, with Apple today releasing a patch for OS X 10.9 Mavericks, OS X 10.8 Mountain Lion and OS X 10.9 Lion.

While other organisations such as Google and Amazon were quick to issue statements about steps they had taken to address the vulnerability, Apple initially downplayed the risk to consumers, saying with OS X systems ‘are safe by default’ and not exposed to remote exploits of bash unless users configure advanced Unix services.

Prentis says the threat is a ‘mixed bag’.

“In the consumer space, exposure is not so large because consumers are less likely to be running web servers or the Linux platform.

“However, in the enterprise space, organisations need to go through a process of incident response.”

52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
GirlBoss wins 2018 YES Emerging Alumni of the Year Award
The people have spoken – GirlBoss CEO and founder Alexia Hilbertidou has been crowned this year’s Young Enterprise Scheme (YES) Emerging Alumni of the Year.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
IDC: Standalone VR headset shipments grow 428.6% in 3Q18
The VR headset market returned to growth in 3Q18 after four consecutive quarters of decline and now makes up 97% of the combined market.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Preparing for the future of work – growing big ideas from small spaces
We’ve all seen it: our offices are changing from the traditional four walls - to no walls. A need to reduce real estate costs is a key driver, as is enabling a more diverse and agile workforce.
Bluetooth-enabled traps could spell the end for NZ's pests
A Wellington conservation tech company has come up with a way of using Bluetooth to help capture pests like rats and stoats.
CERT NZ highlights rise of unauthorised access incidents
“In one case, the attacker gained access and tracked the business’s emails for at least six months. They gathered extensive knowledge of the business’s billing cycles."