Shellshock Bash hackers found gearing up for broader attacks

Attackers exploiting the Shellshock vulnerability that was discovered in a widely used component of Mac OS X, Linux and Unix had infected by Thursday hundreds of systems with exploratory malware.Security vendor AlienVault used a honeypot to trap two pieces of malware used to infect systems compromised through the critical flaw in GNU Bash, the default command shell for the affected operating systems. Bash stands for Bourne Again SHell.Proof-of-concept exploits have shown that the zero-day vulnerability published Wednesday can be used to commandeer systems and access others on a network. The flaw poses the biggest immediate threat to Web servers running Linux. However, Bash is also found in routers and in Linux-based devices found on the Internet of Things.Researchers believe the number of potentially vulnerable devices could be at least 500 million, making the flaw as widespread as the infamous Heartbleed OpenSSL bug.Bash is able to run an application-sent command that sets environment variables, which are dynamic, named values that affect the way processes are run by a computer. The flaw enables an attacker to tack on malicious code to an environment variable and send it for execution on a vulnerable server via the Common Gateway Interface (CGI), which is a… Read full this story

Shellshock Bash hackers found gearing up for broader attacks have 313 words, post on www.csoonline.com at September 25, 2014. This is cached page on Vietnam Colors. If you want remove this page, please contact us.