yeahforbes
Joined 12 years ago
Karma
6
Submissions
9
Member since
Sep 15
Recent submissions
Comment · 11 years ago
Sorry, should've searched for previous thread located at https://news.ycombinator.com/item?id=9682312
Comment · 12 years ago
Yeah, the entire script is horrifying. It's been a long time since I've seen malware source, especially targeting *nix.
Comment · 12 years ago
In bash, function definitions can be exported via environment variables; in handling that bash also executes whatever immediately follows the function definition; Apache sets environment variables (without sanitizing them for the above) based on incoming HTTP request headers which are controlled by end user clients.
Because this functionality in bash predated Apache, it could be argued that Apache ought to perform sanitization before setting env vars from user input given that bash might execute it, but on the other hand bash's ability for data to be executed as code was pretty much undocumented and is now considered the bug.
Wikipedia has a good explanation at http://en.wikipedia.org/wiki/Shellshock_(software_bug)
Comment · 12 years ago
I'm doing the same, and wondering to myself if that string is actually comprehensive. Are there variants, and if so can they be included as log search patterns without tons of false positives?
I've got lots of wget commands in there like guylhem noted, attempting to either drop a script (and clean up) or phone home to normal random websites that were unfortunately compromised. The phone home requests have all sorts of URIs containing things from my hostnames to unique IDs.
Comment · 12 years ago
I would guess that for (m)any breaches that have occurred so far, the owner might not have even checked for evidence nor have the thieves bragged yet. Time will tell.
Comment · 12 years ago
Excellent so far, although I've always thought of the entire interactive userland as the shell -- not only CLI, but also GUI, as each wraps the kernel on sort of the same plane.
Comment · 12 years ago
I'd be interested in a source pointing out the origin of that obligation. I very much agree that end-to-end encryption is superior for transactions that need it. Some don't need it though, and MITM'd encryption does at least protect the end user from any untrusted parties on their local subnet like in coffee shops, which are far more untrusted than upstream operators.
Comment · 12 years ago
I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)