05Oct2014 (UTC +8) Since QNAP is a common NAS that I see it posted in TipidPC quite often, heads-up on a a simple PoC sploit against QNAP just using curl has been posted:
http://seclists.org/oss-sec/2014/q3/806 Here's a good tech analysis on how attacks have been happening: http://www.fireeye.com/blog/technical/2014/10/the-shellshock-aftershock-for-nas-administrators.html --Drexx On Mon, Sep 29, 2014 at 4:50 PM, Ian Dexter R. Marquez wrote: > It's not over yet: > > http://lcamtuf.blogspot.co.uk/2014/09/bash-bug-apply-unofficial-patch-now.html > > TL;DR Studying the original "Shellshock" exploit brought forth > numerous other problems with the Bash function parser. CVEs are > cropping up like flies. Hope vendors catch up. > > Interesting article about exploits in the wild: > > http://www.fireeye.com/blog/uncategorized/2014/09/shellshock-in-the-wild.html > > On Fri, Sep 26, 2014 at 12:44 PM, Drexx Laggui [personal] wrote: >> 26Sep2014 (UTC +8) >> >> I presume most of you have heard the news about Shellshock already. >> Here are more actionable information about the issue. >> >> Some are saying it's as big as a problem as Heartbleed, but my gut >> feeling disagrees. I maybe wrong though. >> >> ******************** >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> >> SANS FLASH REPORT: The Shellshock vulnerability: What you should do now. >> >> September 25, 2014 >> >> Shellshock merits this FLASH report because it is so widespread and so >> easy to exploit on systems like your firewalls and web servers and >> other similarly important servers running LINUX. >> >> >> Johannes Ullrich, Director of SANS Internet Storm Center just updated >> a brief webcast to provide authoritative answers to the five questions >> we are being asked: >> >> 1. How important is Shellshock (which specific types of systems can >> actually be exploited now)? >> >> 2. What is the primary way that this vulnerability is being exploited? >> >> 3. What went wrong? Where did the vulnerability come from? >> >> 4. How can you find out which of your systems are vulnerable? and How >> easy it is for attackers to find the vulnerable systems on your >> network? >> >> 5. How can you protect yourself? >> >> You can see the slides and listen to his briefing at: >> https://isc.sans.edu/forums/diary/Webcast+Briefing+Bash+Code+Injection+Vulnerability/18709 >> >> Storm Center has also posted a FAQ which is being updated as new data is >> found: >> https://isc.sans.edu/forums/diary/Update+on+CVE-2014-6271+Vulnerability+in+bash+shellshock+/18707 >> >> Alan Paller, Director of Research, SANS institute >> [...] >> ******************** Drexx Laggui -- CISA, CISSP, CFE Associate, ISO27001 LA, CCSI, CSA http://www.laggui.com ( Manila & California ) Computer forensics; Penetration testing; QMS & ISMS developers; K-Transfer PGP fingerprint = 0117 15C5 F3B1 6564 59EA 6013 1308 9A66 41A2 3F9B _________________________________________________ Philippine Linux Users' Group (PLUG) Mailing List http://lists.linux.org.ph/mailman/listinfo/plug Searchable Archives: http://archives.free.net.ph
