Patching is best to address Shellshock/Bash bug, but blocking attacks before they get to vulnerable machines is quicker
Shellshock/bash bug exploits can force compromised servers to act as bots and, depending on the types of privileges the servers have, attackers can make them do a lot worse. So corporate security pros should patch important affected machines as soon as possible.
In the meantime, you can shore up defenses around servers with the bash vulnerability to block attacks before they reach the machines, security experts say.
+ Also on Network World: Shellshock flaw leaves OS X, Linux, more open to attack; 15 (FREE!) security tools you should try +
These outside defenses can include new rules for Web application firewalls and network intrusion devices that would pick up on attack signatures, says Jeff Schilling, CSO of secure cloud provider Firehost and the former head of the U.S. Army Security Operations Center.
Snort, for example, has issued rules to cover the vulnerability via its open IDS/IPS, as have most commercial IDS/IPS vendors.
shellshock command diagram 600px v2 Symantec
Corporate IT departments should apply the patches that are available via the various vendors of the operating systems, he recommends. Depending on how many machines are affected, this could take months.
shellshocked3
To start, security executives should identify what machines are affected and monitor them for suspicious activity, experts say. In order to exploit the vulnerability, attackers need to access the machines, which is accomplished via some other security weakness.
It may be done using compromised credentials, so security teams should pay particular attention to which users have logged into the machines and what they tried to do when logged in, says Trey Ford, the global security strategist for Rapid 7. Credentials may have to be changed.
Exploiting the vulnerability is fairly trivial, Ford says, once the attacker has access to the machine. Those most likely to be hit are connected to the Internet, running Linux and using the bash Unix shell. Many of the servers fitting Ford’s description are in DMZs where there will likely be a limited number of other devices, he says.
Measuring the risk should include seeing what other devices are on the same network with the compromised server. Those machines that are connected to the Internet should be protected and patched first, then those that have the most impact on normal line-of-business functions, he says.
Bash is a command processor, which means it takes orders from a command line or from applications and executes them. The vulnerability allows attackers to sneak in malicious commands to it that it will then execute. This requires access to the machine through some other security weakness, and limits actions to whatever actions the server has rights to perform and the privileges of the user whose credentials were used to sign in.
Exploiting the vulnerability does not enable attackers to escalate privileges on compromised machines, which significantly lowers the risk that the bash vulnerability presents, says Schilling. He ranks its severity at four or five out of 10. By comparison, he says the Heartbleed vulnerability was an eight or nine.
He says his company has implemented IDS/IPS rules against bash attacks and turned back 1,000 or so within 12 hours. “It’s like everybody had a new toy and wanted to try it,” he says.
Best Microsoft MCTS Training – Microsoft MCITP Training at Certkingdom.com
Post your comments