4,120 reputation
2719
bio website
location
age
visits member for 2 years, 10 months
seen 6 hours ago

15h
reviewed Approve suggested edit on One liner to create passwords in linux?
2d
revised what are the best security certifications for beginners with no experience in IT
added 666 characters in body
2d
answered what are the best security certifications for beginners with no experience in IT
Oct
19
comment What is a specific example of how the Shellshock Bash bug could be exploited?
Most apps need access to read /etc/passwd. It's very unusual to restrict it, this goes way back but it might be interesting, from the time when /etc/shadow was being introduced on Slackware: tldp.org/HOWTO/Shadow-Password-HOWTO-2.html They give an example of the 'ls' command unable to show usernames.
Oct
15
reviewed Approve suggested edit on SSL3 “POODLE” Vulnerability
Oct
15
reviewed Approve suggested edit on Hardware encrypted external HDDs
Oct
10
reviewed Reject suggested edit on Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?
Oct
9
reviewed Approve suggested edit on Where are the anonymous/private domain validation SSL certs?
Oct
4
reviewed Approve suggested edit on How to generete dictionary for brute force attack?
Oct
4
reviewed Approve suggested edit on John the Ripper - Calculating brute force time to crack password
Oct
1
reviewed Approve suggested edit on Does Outlook store plain-text passwords?
Sep
30
answered Shellshock plus sudo/su environment whitelist bypass - big problem?
Sep
30
comment What is a specific example of how the Shellshock Bash bug could be exploited?
If you do a system("set") it shows the interpreter and the full set of environment variables. My Debian box has a few years on it and is running Squeeze LTS which uses bash.
Sep
29
comment What is a specific example of how the Shellshock Bash bug could be exploited?
@CharlesDuffy that's a good point. I checked it and it is /bin/sh, which is a symlink to /bin/bash. But even if it was bash, this method would not work because the environment variables were not passed to the shell in my test. (for an out-of-box Redhat 6.5). If you find otherwise, please let me know.
Sep
29
comment What is a specific example of how the Shellshock Bash bug could be exploited?
@rubo77 The CGI exploit against shellshock is just one attack vector. Another vector is the DHCP client for Linux systems. I expect there will be more. The above example is only for cgi. It's best not to assume we know all the vectors.
Sep
29
awarded  Great Answer
Sep
28
comment What is a specific example of how the Shellshock Bash bug could be exploited?
That's roughly it, see the IETF doc, p8, HTTP_*. N.b. there are a bunch of others in the HTTP_* group which I haven't tried, but should also work, like HTTP_ACCEPT, HTTP_ACCEPT_ENCODING, HTTP_ACCEPT_LANGUAGE...
Sep
28
comment What is a specific example of how the Shellshock Bash bug could be exploited?
The environment variables are made available to bash verbatim as part of the CGI design. tools.ietf.org/html/draft-robinson-www-interface-00 bash allows function definitions in environment variables, but the bug causes code after the function definition to be executed. It's as ridiculous as it sounds.
Sep
27
reviewed Approve suggested edit on Is e-mail sent from a Gmail address to another Gmail address encrypted?
Sep
27
comment What is a specific example of how the Shellshock Bash bug could be exploited?
The semicolon replaces a newline so that it can fit on one line. The semicolons are unnecessary if you can replace them with newlines.