So today was supposed to be a normal Wednesday. I had a to-do list with "finally write that post about RSS readers" on it and everything. Instead I spent from about 9pm until nearly 1am hunched over an SSH session patching bash on every box I have a login for, because of this Shellshock thing that broke this morning.
If you haven't seen it yet: there's a bug in Bash, the shell that's probably running on every Linux and Mac machine you own, that's been sitting there since basically forever (people are saying it traces back to 1989, which is a fun thing to think about while you're up late fixing it). The short version is that Bash will execute code stuffed into an environment variable if you format it a certain way, and a shocking number of things — CGI scripts, DHCP clients, random embedded devices — pass untrusted input straight into environment variables without a second thought. Redhat and the various distro maintainers pushed out patches basically as soon as it went public, which is good, but "public" also means every script kiddie with a terminal now knows too.
I don't run anything huge. Two cheap VPS boxes, one for this blog and one that hosts a handful of side projects nobody but me and about four other people ever look at. But one of those side projects has a contact form from like 2012 that shells out to a Perl script for spam filtering, and the second I read the word "CGI" in the writeups I had a genuine oh no moment and went and checked it. It was fine, thankfully, but checking took way longer than it should have because I'd completely forgotten how that script even worked and had to read my own code like it was written by a stranger. Which, honestly, it kind of was. Two years is a long time in blog years.
The patching itself was simple enough. apt-get update && apt-get install --only-upgrade bash on the Debian box, done in about ninety seconds. The actual work was the paranoid part afterward: going through cron jobs, checking what's listening on which ports, grepping old scripts for anything that touches $HTTP_ headers or query strings and feeds them to a shell. I found nothing else alarming, for the record, but I did find a genuinely embarrassing shell script from early 2013 with a hardcoded password in it that has nothing to do with today's bug and everything to do with past-me being lazy. That's getting fixed too, separately, quietly, and I am not going to elaborate further.
What's been bugging me all night isn't really the vulnerability itself, it's how casually it's being talked about relative to how bad it actually is. Heartbleed back in April got wall-to-wall coverage, its own logo, the works, and this feels like it should be treated the same way or worse, because Heartbleed let you read memory and this one lets you run arbitrary commands. I get that "remote code execution in a 25-year-old shell" is a less catchy pitch than "the internet's encryption is broken," but functionally this is the scarier bug. A friend of mine who does ops for an actual company (not a two-VPS hobby operation like me) texted me around 11 saying their team found something like six different internal services vulnerable, including one nobody remembered was even still running. That's the real danger with a bug like this: it's not the stuff you're actively thinking about, it's the stuff you forgot existed.
Small unrelated complaint while I'm here: I also updated my phone to iOS 8.0.1 this afternoon before any of this started, and a friend of mine on the same update says her cell signal and Touch ID both stopped working afterward. Mine's fine so far, knock on wood, but that's a rough one to ship less than a week after the iPhone 6 launch. Not a great week for anybody shipping updates, apparently.
Anyway. If you're running any kind of server, even a tiny hobby one, go check your bash version right now: bash --version, if it says 4.3 and the patch level is anything below 25 or so depending on your distro, go update it before you do anything else, including reading the rest of whatever you were reading. I'll get back to the RSS reader post eventually. Probably this weekend. No promises.