Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:20 AM
Paul Vixie
Paul Vixie
Connect Directly
E-Mail vvv

Shellshocked: A Future Of ‘Hair On Fire’ Bugs

Most computers affected by Bash will be updated within 10 years. The rest will be vulnerable for the lifespans of all humans now living. This should concern us. But then, global warming should also concern us.

It seems that the more we integrate our lives and our national economies into the Internet, the less safe we, and our privacy, and our money, become. The human population will eventually grow weary of the endless parade of worldwide hair-on-fire technology problems like Y2K, Conficker, Heartbleed, and, as of this week, Shellshock.

By “weary” I mean thoughts like “Another day, another bug, I have no time for this, I’ll upgrade everything when I get the time.” We may already be there, given that six full years after the Conficker worm was announced, we still see about a million unique IP addresses per day in the Conficker sinkhole. Those can’t all be student researchers checking to see if the botnet still exists. Sadly, every hour of delay dramatically increases the likelihood that the device will become more deeply infected before it is patched -- after which time, patches won’t actually make anything better.

Aggregate attack surface is a progressive concept. When the total number of infected or vulnerable computers, and the total number of infections and vulnerabilities themselves, were small, the criminal miscreants of the world did not have as much free infrastructure to draw from when attacking new targets. Make no mistake, the bad guys don’t pay for hardware or connectivity -- they’re using ours instead, since ours is free, and this kind of indirection helps them hide their tracks and misdirect our investigations. Today the computational resources available to the bad guys have grown to the point where no victim is out of reach, and no attacker has to be all that frugal or even quiet about its attacks.

Shellshock is the name of a bug in “Bash,” an acronym for Bourne Again Shell, a command line interpreter present on most computers in the world except for Windows. Bash is in Linux, and Linux is in just about every embedded computer including smart TVs, smartphones and tablets, home gateways, wireless access points, Internet servers, and many industrial control systems.

There is not a quality problem with Linux per se. In fact, Linux may be the most reviewed, most tested, highest quality (per line of code) system in history. However, there’s an awful lot of code and an awful lot of interfaces -- connections between different parts of code -- and with complexity comes error just as surely as night follows day. More importantly, many devices containing Bash are not field upgradeable, either for cost reasons or because their makers died out. Even among devices that are still upgradeable, most are silent, unknown trolls in dark closets with no monitoring or auditing or management at all.

Fix they did, but…
Within a few hours of the announcement of Shellshock and the first software update to fix the bug (which fix did, by the way, turn out to be incomplete), those of us who watch the Internet for malicious activity saw hundreds of researchers scanning billions of Internet addresses, all trying to measure and catalogue attack surface.

It’s safe to assume that some of those researchers have evil intent, such as adding the vulnerable computers to a botnet, to be used later for launching DDoS attacks or similar malfeasance. And as always during times of emergency, misinformation and misunderstanding was everywhere, even in some official announcements from people and companies and agencies whose purpose in life is to keep us informed and safe against online threats.

It’s conservative to estimate that for every modern computing device we actually know is a computing device, and whose manufacturer still has the ability to update its software, there are at least 10 other computing devices that we don’t know much about, which will not have their software updated ever, and which have years or even decades of life left.

Experience tells us to expect that the computers that will be updated will be mostly updated within about 10 years. Most of the rest will be vulnerable until they die, which will take some decades, and a few million of them will still be running and still be vulnerable to Shellshock for the lifespans of all humans now living. This should concern us, but then, global warming should also concern us.

As the saying goes, “When you’re stuck in a hole, the first thing to do is stop digging.” Given the inevitability of software bugs and the growing dependence on technology for banking, communications, infrastructure, agriculture, and food supply, can we afford to continue driving innovation guided only by near-term profit, where technology’s winners are always those who pursue time-to-market over quality?

By all means, let us patch Bash wherever we can find it. But that’s busy work. The vulnerable Bash instances that we won’t find vastly outnumber those we will, and our future is going to be dominated by leftovers from an endless parade of hair-on-fire bugs that we eventually learn to live with when the next one comes along and steals our attention.

Dr. Paul Vixie is an Internet pioneer and thought leader who designed, implemented, and deployed several Domain Name System (DNS) protocol extensions and applications that are used throughout the Internet today. He is CEO of Farsight Security Inc. Previously, he served as ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 3
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 4:14:13 PM
Great analysis but is it really so hopeless?
It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on.... 
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 4:09:35 PM
hair-on-fire bug fatigue
Your point about this being another in a series of major flaws we'll face is so true, @Paul. What is worrisome is how this could spawn bug fatigue, almost like we're seeing in the wave of retail data breaches. Another day, another major Internet flaw is exposed. How does the industry avoid that?
<<   <   Page 3 / 3
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-25
The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request, leading to Remote Code Execution.
PUBLISHED: 2020-09-25
Zoho ManageEngine Applications Manager before 14 build 14730 has no protection against jsp/header.jsp Cross-site Scripting (XSS) .
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552).
PUBLISHED: 2020-09-25
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).