Easy, realtime, system-wide Shellshock monitoring

[frankzinger]

Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)?

Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.

[noonespecial]

I have some truly old (disk) images going back to around 2003. I've looked through them and found nothing.

What freaks me out though is that these systems were vulnerable. All this time; it was right there. Its like finding out you just drove from LA to NYC with nothing but a single loose lug nut on your left front tire.

[LeoPanthera]

Yeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.

[PierreDow]

I'll give props to hackers clever enough to poke holes in a massive beast of a system that enjoys boasting itself as "impenetrable", but these, I'm not too happy about - http://www.pressreader.com/profile/Media_Mentions/shellshock. The potential effects are much too close for comfort.

[RobotCaleb]

Just so I understand fully, this doesn't block attempts, just logs them?

[davideschiera]

Correct. It will log time, process name/pid, and what's going to be executed.

[mikegioia]

This looks cool but I can't get it running on Ubuntu 14.04. I just installed sysdig but I don't have the shellshock_detect chisel :/ Is it available yet through apt?

[gighi]

What do you get if you run "sysdig --version"?

If you used the official Ubuntu packages, those are a few versions behind upstream (currently at 0.1.87 while we are at 0.1.89): http://packages.ubuntu.com/trusty-backports/sysdig.

What we recommend is uninstalling those ones (sysdig and sysdig-dkms) and just use the binaries that we, Draios, provide, following this: https://github.com/draios/sysdig/wiki/How-to-Install-Sysdig-...

Should be very easy, and sysdig --version should show 0.1.89

[kaivi]

I guess there are already worms around, exploiting this bug.

Thus, has somebody thought of exploiting and patching the attackers in response?

[daveloyall]

I haven't studied a worm in years, but historically it's been common practice to close the door you came in through upon entry, for exactly this reason.

Common, but by no means ubiquitous.

[nicklaforge]

shellshock_detector.lua seems to let this more obscure exploit slip by, undetected:

http://seclists.org/oss-sec/2014/q3/696 http://seclists.org/oss-sec/2014/q3/734

[tyleroderkirk]

that has now been fixed: https://github.com/draios/sysdig/pull/252

[Tepix]

Seems like an interesting article, however with the super thin font and the grey-text-on-grey-background it's just too hard to read.

The authors need a visit to http://contrastrebellion.com/

[column]

http://rdd.me/ei7jpz02

[zobzu]

well, installing a LKM, just that =p

Now sysdig aint bad per se but id like to see it mainlined or using mainline code

[gighi]

Fair point, even though:

- At this point sysdig is estimated to have tens of thousands of users, and we haven't gotten a kernel bug in a while, with people (us included) regularly using it a lot in production. Of course, I see the irony of mentioning this in a "shellshock" thread

- the dkms packaging should completely hide all the complexities required in maintaining a kernel module

- Part of the kernel code, if you look at the contributors, has been written/reviewed by gregkh, so we like to think the quality is "high enough"

- There might be plans at some point to try and propose a merge of the code to mainline