Shellshock is used by Botnet, vulnerability release will lead to disaster again?
Recently, the widely-used GNU Bourne Again Shell(Bash) in Unix and Linux operating system was found a severe security vulnerability that allows to be remotely execute code. This vulnerability was called Shellshock.
Shellshock has been described as one of the most serious and most common network security vulnerabilities so far, even the government and military system with highest technology became susceptible owing to Shellshock. Therefore some experts pointed out that the severity of Shellshock even exceeded the Hear bleeding vulnerability that caused panic on network security professionals.
According to the Financial Times reports, the U.S. Department of Homeland Security has confirmed the existence of this vulnerability, and has warned the public and private sectors or organizations around the U.S.; British intelligence agency Government Communications Headquarters (GCHQ) issued a warning to British agencies, claiming that this vulnerability affected country critical infrastructure.
The terrible points of Shellshock vulnerabilities are: First, omnipresent, from the web server to the physical networking equipment; second, the latent time can last for 20 years, so its damage and threats assessment is extremely difficult. These two points are similar to heart bleeding.
According to Arstechinica, there were attackers scanning and using Shellshock vulnerability within 4.5 hours after Blue Coat has found it, and there were DDoS Botnet using Shellshock in attacks. But there is no evidence showing that hackers beware of this vulnerability before releasing, which is also similar to the heart bleeding vulnerabilities.
This means Shellshock release is likely to repeat the tragedy of heart bleeding vulnerabilities, resulting in a large number of attacks occurred, which poses a new question for the entire security community. At present many security companies are publishing Shellshock vulnerability scanning diagnostic tools, people can search one to diagnose your computer.
For more information about data security and information protection, you can visit here.