Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/26/2014
10:20 AM
Paul Vixie
Paul Vixie
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Shellshocked: A Future Of ‘Hair On Fire’ Bugs

Most computers affected by Bash will be updated within 10 years. The rest will be vulnerable for the lifespans of all humans now living. This should concern us. But then, global warming should also concern us.

It seems that the more we integrate our lives and our national economies into the Internet, the less safe we, and our privacy, and our money, become. The human population will eventually grow weary of the endless parade of worldwide hair-on-fire technology problems like Y2K, Conficker, Heartbleed, and, as of this week, Shellshock.

By “weary” I mean thoughts like “Another day, another bug, I have no time for this, I’ll upgrade everything when I get the time.” We may already be there, given that six full years after the Conficker worm was announced, we still see about a million unique IP addresses per day in the Conficker sinkhole. Those can’t all be student researchers checking to see if the botnet still exists. Sadly, every hour of delay dramatically increases the likelihood that the device will become more deeply infected before it is patched -- after which time, patches won’t actually make anything better.

Aggregate attack surface is a progressive concept. When the total number of infected or vulnerable computers, and the total number of infections and vulnerabilities themselves, were small, the criminal miscreants of the world did not have as much free infrastructure to draw from when attacking new targets. Make no mistake, the bad guys don’t pay for hardware or connectivity -- they’re using ours instead, since ours is free, and this kind of indirection helps them hide their tracks and misdirect our investigations. Today the computational resources available to the bad guys have grown to the point where no victim is out of reach, and no attacker has to be all that frugal or even quiet about its attacks.

Shellshock is the name of a bug in “Bash,” an acronym for Bourne Again Shell, a command line interpreter present on most computers in the world except for Windows. Bash is in Linux, and Linux is in just about every embedded computer including smart TVs, smartphones and tablets, home gateways, wireless access points, Internet servers, and many industrial control systems.

There is not a quality problem with Linux per se. In fact, Linux may be the most reviewed, most tested, highest quality (per line of code) system in history. However, there’s an awful lot of code and an awful lot of interfaces -- connections between different parts of code -- and with complexity comes error just as surely as night follows day. More importantly, many devices containing Bash are not field upgradeable, either for cost reasons or because their makers died out. Even among devices that are still upgradeable, most are silent, unknown trolls in dark closets with no monitoring or auditing or management at all.

Fix they did, but…
Within a few hours of the announcement of Shellshock and the first software update to fix the bug (which fix did, by the way, turn out to be incomplete), those of us who watch the Internet for malicious activity saw hundreds of researchers scanning billions of Internet addresses, all trying to measure and catalogue attack surface.

It’s safe to assume that some of those researchers have evil intent, such as adding the vulnerable computers to a botnet, to be used later for launching DDoS attacks or similar malfeasance. And as always during times of emergency, misinformation and misunderstanding was everywhere, even in some official announcements from people and companies and agencies whose purpose in life is to keep us informed and safe against online threats.

It’s conservative to estimate that for every modern computing device we actually know is a computing device, and whose manufacturer still has the ability to update its software, there are at least 10 other computing devices that we don’t know much about, which will not have their software updated ever, and which have years or even decades of life left.

Experience tells us to expect that the computers that will be updated will be mostly updated within about 10 years. Most of the rest will be vulnerable until they die, which will take some decades, and a few million of them will still be running and still be vulnerable to Shellshock for the lifespans of all humans now living. This should concern us, but then, global warming should also concern us.

As the saying goes, “When you’re stuck in a hole, the first thing to do is stop digging.” Given the inevitability of software bugs and the growing dependence on technology for banking, communications, infrastructure, agriculture, and food supply, can we afford to continue driving innovation guided only by near-term profit, where technology’s winners are always those who pursue time-to-market over quality?

By all means, let us patch Bash wherever we can find it. But that’s busy work. The vulnerable Bash instances that we won’t find vastly outnumber those we will, and our future is going to be dominated by leftovers from an endless parade of hair-on-fire bugs that we eventually learn to live with when the next one comes along and steals our attention.

Dr. Paul Vixie is an Internet pioneer and thought leader who designed, implemented, and deployed several Domain Name System (DNS) protocol extensions and applications that are used throughout the Internet today. He is CEO of Farsight Security Inc. Previously, he served as ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 3
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 4:14:13 PM
Great analysis but is it really so hopeless?
It patching is simply busy work, what real work needs to be done? I for one don't look forward to a future with my hair on fire watching the bug parade go on and on.... 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 4:09:35 PM
hair-on-fire bug fatigue
Your point about this being another in a series of major flaws we'll face is so true, @Paul. What is worrisome is how this could spawn bug fatigue, almost like we're seeing in the wave of retail data breaches. Another day, another major Internet flaw is exposed. How does the industry avoid that?
<<   <   Page 3 / 3
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0258
PUBLISHED: 2020-02-17
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
CVE-2015-6922
PUBLISHED: 2020-02-17
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setA...
CVE-2020-9043
PUBLISHED: 2020-02-17
The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
CVE-2020-1704
PUBLISHED: 2020-02-17
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privi...
CVE-2019-12954
PUBLISHED: 2020-02-17
SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT.