There’s nothing like the words “worse than Heartbleed” to get a chief information security officer’s pulse racing, which is why reports of a bug in the open-source software known as Bash may have them canceling any plans they might have had this weekend.
Red Hat Software was among the first to disclose details about the Bash bug, also known as Shellshock. This bug involves a vulnerability that would allow malicious hackers to bypass security measures and take over a user’s computer by simply cutting and pasting a line of code. The hole allows cybercriminals to potentially steal files, change settings and access other personally identifiable information.
Several reports have already compared this bug to Heartbleed, a flaw in the encryption code of another open-source software application, OpenSSL, which is widely used in many websites. However, Heartbleed was largely a problem because it could let hackers see information; Bash could up the ante by allowing cybercriminals to actually take over users’ machines.
How Bash Shellshock Bug Could’ve Been Avoided 7 Years Ago
As security expert Troy Hunt explained on his personal blog, Bash may also be even more prevalent than OpenSSL, given that it was created in the 1980s and is practically a default utility on Mac OS X and Linux as a way to execute commands without touching screens or using a mouse.
Even scarier, a story on CNN Money noted that the Bash bug has emerged just as more smart devices, which connect to IP but are controlled without PCs, are entering homes and offices. Bash could be an option to turn smart thermostats or lights on and off, vastly increasing the number of potential endpoints where damage could be done.
Beyond isolated attacks on individual victims, a number of security experts on Twitter were speculating that someone will work quickly to create a worm that exploits the Bash bug. This means that malware infecting a machine could spread extremely quickly.
As a first step, businesses should evaluate the degree of risk they face. The Register published a post with a simple command line that can be entered to test a particular system. Beyond that, it’s going to be a matter of waiting for effective patches from Red Hat and other vendors that fully address the scope of the vulnerability. While the word “bash” suggests being struck hard and quick, the impact of the Bash bug may be felt for months, if not years, to come.