Shellshock Code & the Bash Bug - Computerphile

[@myne4]

I'd just like to interject for a moment. What you're referring to as GNU/Linux is in fact... GNU/Linux.

[@RonJohn63]

myne4 Or is it GNU/X/{GNOME|KDE|XFCE|LXDE}/Mozilla/LibreOffice/Linux?

[@MrCreeperX]

Wut?

[@ekanshdeepgupta658]

Umm, can someone explain?

[@RonJohn63]

Ekanshdeep Gupta No, we can't. You must be a Unix nerd to understand.

[@yasyasmarangoz3577]

@@RonJohn63 Just explain it xD

[@AndrewMeyer]

Opening line is technically inaccurate (though probably correct enough for most purposes): "This line of code is the Shellshock exploit." Not quite. That line just demonstrates the exploit, it isn't the exploit itself. "I'm using it here to check whether my system is vulnerable to the shellshock bug." That line just checks whether your version of bash is vulnerable, not whether your system is vulnerable. Whether your system is vulnerable or not is a bit more complicated to determine. Just thought I'd point that out. (Sorry to be so pedantic.)

[@yawor]

I totally agree. For the system to be vulnerable an attacker still needs some attack vector allowing him/her to exploit the bug in the bash. CGI scripts can be such a vector, but newer technologies like FastCGI, WSGI are not (data from front end server like Apache is not being send to back end application via shell environment variables). Unfortunately this still leaves many devices and servers vulnerable as there are still many CGI apps out there.

[@FishKungfu]

"How We Got to Now" reminds me of James Burke's "Connections" tv show.

[@ZardoDhieldor]

This looks so simple. How come this wasn't found for the last 20 years?

[@bloody_albatross]

Look at the source of bash and you'll know. The source of bash isn't that simple. Maybe something similar like OpenSSL: "Eew, no, I don't want to contribute to a project with such a source."

[@JarinUdom]

Well of course it's simple once you know about it

[@ZardoDhieldor]

Jarin Udom But there sure was someone who tested it for bugs or something! I don't get how this stayed unnoticed for over a quarter of a century! Well, maybe it's just been luck.

[@jamesrawlings8493]

Zardo Schneckmag There are (literally) thousands of different use cases which have to be tested for something as complex as bash. This is something which could have been tested but probably was not thought to do. Testing the function definition feature probably missed it. As others have said its taken decades before someone realized this could be done.

[@bloody_albatross]

***** How can it beat C++ if it is a subset thereof? Also games and non Gtk GUI applications are usually written in C++ (and some in Objective C).

[@Floodric1991]

His response to Brady's question at the end made me lose it

[@Coolfolder]

I feel like this left me a bit hanging. How would this bug allow somebody else to gain access to my computer?

[@iliakorvigo7341]

You can use that to download and execute malware.

[@AureliusR]

@@abdulelahfallatah It's not a "virus", it's just a bug in the way it interprets environment variables. This won't affect systems that don't use bash, and this was immediately patched and is no longer an issue on modern *nix systems.

[@LeiosLabs]

I would like to point out that most distros have a fix already. If you are vulnerable, be sure to update quickly!

[@violencechildren7603]

this just inspired to do some automation on my ubuntu

[@MrMebelMan]

1:48 you're using a string comparison '=' instead of numeric comparison '-eq'. It doesn't matter much tho ;)

[@CelmorSmith]

Knew already about that Exploit but didn't know my Smartphone was also vulnerable. Are both iOS and Android affected? Sure, Android is based on the Linux Kernel but that it had also bash was new to me.

[@IceMetalPunk]

Android, as far as my research shows, is not vulnerable as it uses a custom shell, not Bash.

[@CelmorSmith]

IceMetalPunk Ah OK.

[@CelmorSmith]

***** Well, I generally use a PC with Windoof and just a cheap Smartphone. Normally you shouldn't even connect to a public networks or be visible from outside the router with your iPhone per port forwarding. Also I will check my router now, it's a FritBox but I don't know if the services running on there are also Linux Kernel based.

[@CelmorSmith]

***** :P

[@esoteridactyl]

***** Also if you're on jailbroken iOS 7 there is a patch in Cydia for it.

[@199NickYT]

Seems very familiar to me...looking at you, unsanitized database queries

[@SniperMayer]

Deserves a thumb up at least for the GNU/Linux correction :^)

[@HashimAziz1]

So basically SQL injection for bash? Shocking that this went unnoticed for so long.

[@Bp1033]

For the longest time I thought that was a feature.

[@alcesmir]

The ability to pass functions through environment variables is a feature. However, exploiting these variables to run code as the variable is parsed is not.

[@Potenti4lz]

So you can run functions other than just echo?

[@Bp1033]

you can pretty much do anything you can do in the terminal with this. lets say wget some script then execute said script.

[@taesheren]

***** So you can use this to execute programs at root level without actually having root access?

[@jasondoe2596]

Taesh No! Not unless you combine it with some other privilege escalation exploit (which would be found elsewhere, not in bash itself). Even if someone can execute arbitrary code, it would be using the (limited) privileges of the user who started the specific bash instance (for example, the web server). Which is the reason that anyone running web services as root fully deserves what's coming at them...

[@kingemocut]

all these "smart" systems getting so many bugs, and i'm just here with my composite TV having a laugh.

[@bloody_albatross]

How do you write KZbin comments on a composite TV?

[@kingemocut]

using my XP SP3 pc w/ dial up kappa

[@bloody_albatross]

kingemocut Yeah, because that's safe. There are no more security updates for XP.

[@kingemocut]

***** no, i was being sarcastic.

[@dipi71]

If you have the Cygwin environment installed on your WinXP system , then you might still use an exploitable bash installed and running.

[@uriituw]

How may I obtain that Bourne Shell book?

[@jagmarz]

Nice catch on the typo on the original exploit, there...

[@shpider916]

So many Atari's in the background! Falcon, and an early non-fm ST

[@dattebenforcer]

What about deleting System 32?

[@WingmanSR]

That typically solves most problems, yes.

[@dattebenforcer]

SBwingman But will they cover it? (and demonstrate it)

[@KurakiN64]

***** Watch Joel’s Windows 98 destruction video.

[@turkyandgravy]

+dattebenforcer Deleting System 32 is a huge bug in the Windows operating system.

[@dattebenforcer]

Ryan Mattox I know, I deleted it from my PC and now it runs super fast and never crashes.

[@blackneos940]

I'd just like to interject for a minute: What you are referring to as GNU/Linux, is, in fact, GNU/BASH/Apt/RPM/Sh/Git/SSH/Linux, or, as I have taken to calling it, GBARShITSL.

[@Borednesss]

This might sound like a dumb question since I don't know how any of this works.. but, was it just the syntax of that code that was recently discovered, or had it been known and someone just figured out how to create exploits with it?

[@JahMusicTube]

If i type helo as in the example at 3:09 on Linux Mint i get a "command not found" message! Why is that? How do i execute an environment function then?

[@JahMusicTube]

Yes to both :D

[@DrRChandra]

A function has to be marked for export, such as by the "-f" option to export. One of Bash's options is to export all newly created variables and functions, and is a settable parameter. One of your files (say /etc/bashrc) may have turned this off; I'm not sure what the default is. As a result, "helo" is not exported into the new environment. Dr. Bagley's Bash environment may be different from yours. It's possible if you were to execute "set -a" before trying that example that it would work. The trouble would be is if your Bash startup files turn that off, the new invocation of bash in that example would not pay attention to your "set -a" command. It may very well be turned off as a response to Shellshock. The maintainers of your GNU/Linux distribution may think the feature is used so little that breaking scripts which depend on this behavior is more acceptable than letting the exported function bug do damage. It's tough to say, I'm just waxing philosophical, and cannot speak for whoever maintains your Bash.

[@JahMusicTube]

rchandraonline It is possible. In fact, i've tried to replicate the bug in another way, but it doesn't seem feasible. 'export -f' only accepts the function name as argument, hence it is safe. What I cannot find is how to turn on automatic export of newly created variables and functions. My bashrc file does not contain anything related apparently, so I'm assuming that by default the feature is turned off. Do you know how to turn it on? Thank you for your explaination btw!

[@Longlius]

Linux Mint doesn't use bash but a somewhat stripped down shell called dash. It doesn't have this bug. en.wikipedia.org/wiki/Almquist_shell

[@DrRChandra]

That'd be "set -a". Use man bash and look at the builtins section where it discusses the set command. I have a really tough time believing Mint does not have Bash. It may be an optional package (not installed by default). I use Fedora and Xubuntu myself, and the latter is a Debian derivative, as are Ubuntu and Mint.

[@Edgewalker001]

Pretty much, if you are using an android phone then it does have BASH. (As I recall, in the usual humoristic way that stands for Bourne Again SHell, as a nod to the original Bourne shell they were talking about.) Android is basically just a lightweight linux distro, it runs the linux kernel and it should also include BASH.

[@turkyandgravy]

+Edgewalker001 While it's true that Android is based of Linux, by Linux they mean the Linux kernel, not GNU, so programs built for Android won't run on Linux, and programs made for Linux won't run on Android unless there's a compatibility layer. Android is about as related to Linux as OSX is.

[@Dudleymiddleton]

Is that an old 1040ST lurking behind?

[@DrSteveBagley]

Atari Falcon.

[@CFalcon030]

DrSteveBagley And a Mega ST next to it. I am not sure what the desktop is though, seems like Teradesk. Anyway, if you are running bash on MiNT for the falcon that was also vulnerable so it's best to update.

[@TechyBen]

The question is, how did such a simple bug get missed? Though I'm assuming it's not as simple as the example showed here?

[@DevSolution]

even if an example exploit is simple does not mean the code that allows for the exploit is. But let's not forget all the awesome bash has given us, and now it is more secure then before, so we should still keep using it.

[@jasondoe2596]

Arguably, it always was a (mis)feature, not a bug.

[@rr1-rr1]

Jardar Oehrn hmmm... how many letters do you have to type to delete your entire hard drive with bash? That's how simple the exploit is.

[@DevSolution]

You circumvented my entire statement there.

[@shagster1970]

Surely it wasnt picked up?? - it is almost a typo!

[@shortcutDJ]

amazing video i learned so much and not only about the bug but in a general sense. 10/10 would watch again

[@THERESAPARTYINMYHEAD]

But....I thought UNIX was invincible?

[@bld86]

wait so why run this? is he using that for his actual pc?

[@JustinKoenigSilica]

so much to apple being "secure" it's just something apple tells it's customers to comfort them to buy their crappy products

[@mckennacisler01]

Where in your email-notifying program is there code that is querying a mail server? Or does bash actually have a command for that?

[@Imagonem]

"scan unseen". Maybe some unix program to check mail on the local mailserver? Bash doesn't have a builtin for checking mail, instead you invoke a unix program from bash to check your mail. For instance you can use the program "curl" to check your gmail inbox.

[@bookmark7853]

4:42 *HOW IS THAT NOT A VIRAL MEME?* looooool

[@Potenti4lz]

So you can run functions other than just echo?

[@Potenti4lz]

Needs root access/privileges though. Thanks.

[@krakenmetzger]

It's weird, somehow I know exactly what this guy looked like when he was 8.

[@spoonikle]

you are only really vulnerable as a webserver or service that uses external variables inputed by users in your service to exacute script funtions using said variables. unless you are running a server on your home pc or smart phone... you have nothing to worry about.

[@NoSuchCommand]

1:59 UUOC spotted :-)

[@amigojapan]

I watched the video and I still can't see how this can be used as an exploit by a person that is not logged as a valid user into my computer.... are we talking about if I run malicious code?

[@seanld444]

If you ran the code yourself, it would harm your computer.

[@ekanshdeepgupta658]

Can someone please explain to me how that is so damaging? Surely, if you can declare environment variables, you can execute code? Or am I mistaken?

[@ekanshdeepgupta658]

Thanks, that explains it!

[@scragar]

You pronounce it Lee-nux, mostly because Linus is Finnish and you pronounce his name Lee-nus.

[@CyborgNinja7]

Is this a vulnerability that is from recent years? Because, to me, it seems like an obvious exploit that should've been picked up since the 80s. I don't know much about Bash, but I did programming when I was younger. Wouldn't you be able to limit the input to a certain length, or a certain variable type? Ignore a semicolon in a string?

[@RonJohn63]

CyborgNinja7 "to me, it seems like an obvious exploit ... I don't know much about Bash" You are a perfect example of the Dunning-Kruger effect.

[@CyborgNinja7]

RonJohn63 That's right. Ignore the rest of the comment. Consider getting a life.

[@ProbablyNotARobot]

+RonJohn63 Hardly, the fact that he himself points out his lack of experience shows that the Dunning-Kruger effect doesn't apply. A better example would be you who assumes that you understand what the Dunning-Kruger effect is even though you clearly don't.

[@CyborgNinja7]

Funny how he says I'm pontificating by asking questions. Real arrogant of me.

[@RonJohn63]

joseph byerly I don't think you know what "pretentious" means.

[@mightyNosewings]

Your phone could have Bash on it, but it probably doesn't. I don't think iOS has Bash by default, and Android is "pure" Linux -- that is, not GNU/Linux -- since it doesn't come with the GNU core utilities.

[@dssssada]

Do people actually use Bash "in the wild"? My (admittedly limited) experience working on (again, admittedly paranoid) projects is that it is not to be trusted because it is relatively new and hasn't stood the test of time like csh or tcsh. The belief that I've seen is that such a young (from the old paranoid perspective) language is prone to exploits like this and won't be universally adopted until it hits the 30 or 35 year mark.

[@THE16THPHANTOM]

i used this to override my old password(i think it was this used). saved me the trouble of re-installing the os and loosing all my documents and music...since i doubted there was anyone who could go through all that trouble to get into my computer, i never asked questions.

[@CosmicAstroDuck]

It seems a lot of these exploits are really based off of syntax exploitation, i.e. xss(cross-site-scripting)

[@garciajero]

it would've been nice how to exploit it through a CGI script or something more realistic.

[@TheRaaaZ47]

Not working on my ubuntu 14.04 LTS as well env helo="() { echo Hello; }" bash t@sys:~$ helo No command 'helo' found, did you mean: Command 'hello' from package 'hello' (main) Command 'hello' from package 'hello-debhelper' (main) helo: command not found

[@TheRaaaZ47]

t@sys:~$$helo (): command not found

[@TheUglyGnome]

Please stop this "GNU/Linux" maddness. If mr Stallman is so jealous to mr Torvalds, it's his peronal problem.

[@bashkillszombies]

*LIES. The bug isn't in me. :(*

[@biscoole]

This guy reminds me of Philip Seymour Hoffman.

[@intelX1000]

Almost disliked for that 'Linux' line, before you corrected it.

[@jasondoe2596]

Almost disliked for that "GNU/Linux" line, after he corrected it ;)

[@maxwell10206]

Is he reading a script or something ? If you notice some of the shots his eyes quickly look to the left (his right) in the video. If he is reading a script then that's pretty lame..

[@Pants4096]

OS X is pronounced "Oh Ess Ten"

[@Yaxqb]

1:49 not bash, it's /bin/sh u liar

[@Communist-Doge]

Interesting!

[@un2mensch]

Sean, those aren't advanced bash features >=)

[@cosmicfrog]

AMIGA !!!!!

[@vicplichota]

Why not simply admit to selfish, expedient, short-sighted, *bad* design?

[@AwesomeCrackDealer]

I didn't understand shit, cap'n

[@matthelton6637]

Already patched in Synology NAS 5.0-4493 Update 7. www.synology.com/en-global/releaseNote/DS412+

[@Momonga-s7o]

First 2 minutes I found you weird, but after you looks kind of handsome.

[@DeviousMalcontent2]

GNU\Linux Master Race reporting in. o7

[@FennecTECH]

i am not volunerable to #shellshocked

[@jeandoe6036]

He looks like someone who knows exactly what he is talking about.

[@atarixle]

I'm sorry, but I still can't see any problem with the so called and hyped "shell shock"! Every user who is allowed to create shell functions is allowed to execute commands aswell. There is absolutely no difference between executing a command directly or after a function definition. Nobody on youtube or anywhere else in the WWW has ever shown a real attact using shell shock other than directly having access to the bash anyway! Additionally, idk why shell shock is so bad, while () { :;}: never has been mentioned except on geek T-Shirts!

[@MidnightSt]

Lol, linux guys, all hackers, cowboy coding away... :-D

[@ahenryb1]

Weird type of handsome

[@MG30001]

Old news!

[@DeeWeext]

Such bad exlpainer

[@JohnDoe_69]

ew linux