September 26, 2014 By Shane Schick 2 min read

There’s nothing like the words “worse than Heartbleed” to get a chief information security officer’s pulse racing, which is why reports of a bug in the open-source software known as Bash may have them canceling any plans they might have had this weekend.

Red Hat Software was among the first to disclose details about the Bash bug, also known as Shellshock. This bug involves a vulnerability that would allow malicious hackers to bypass security measures and take over a user’s computer by simply cutting and pasting a line of code. The hole allows cybercriminals to potentially steal files, change settings and access other personally identifiable information.

Several reports have already compared this bug to Heartbleed, a flaw in the encryption code of another open-source software application, OpenSSL, which is widely used in many websites. However, Heartbleed was largely a problem because it could let hackers see information; Bash could up the ante by allowing cybercriminals to actually take over users’ machines.

How Bash Shellshock Bug Could’ve Been Avoided 7 Years Ago

As security expert Troy Hunt explained on his personal blog, Bash may also be even more prevalent than OpenSSL, given that it was created in the 1980s and is practically a default utility on Mac OS X and Linux as a way to execute commands without touching screens or using a mouse.

Even scarier, a story on CNN Money noted that the Bash bug has emerged just as more smart devices, which connect to IP but are controlled without PCs, are entering homes and offices. Bash could be an option to turn smart thermostats or lights on and off, vastly increasing the number of potential endpoints where damage could be done.

Beyond isolated attacks on individual victims, a number of security experts on Twitter were speculating that someone will work quickly to create a worm that exploits the Bash bug. This means that malware infecting a machine could spread extremely quickly.

As a first step, businesses should evaluate the degree of risk they face. The Register published a post with a simple command line that can be entered to test a particular system. Beyond that, it’s going to be a matter of waiting for effective patches from Red Hat and other vendors that fully address the scope of the vulnerability. While the word “bash” suggests being struck hard and quick, the impact of the Bash bug may be felt for months, if not years, to come.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today