3

Registration card in hand, I went to register a newly purchased power tool yesterday. But when I arrived at the manufacturer's site, I was greeted by an ancient homegrown interface that was marked "Copyright (C) 2004" and looked like HTML 1.0. Attempting to connect via https yielded an invalid TLS certificate and no access to the page. The redirected registration URL looked very much like "http://apache.somecompany.com/cgi-bin/registration.htm" Everything stank of unpatched vulnerabilities, but the site admin replied to my query and assured me that their Oracle warranty registration system was secure. (Never mind that an Oracle machine probably wouldn't be named "apache".)

I decided owning an unregistered gasoline powered tool with giant spinning blades was safer than entrusting them with my name and address. I'm not even sending them the post-paid card in the snail mail, because I don't see any evidence of security at their end.

But what I really want to know is if there is a way for me to evaluate their site without really attacking them, or if there is someone offering a "Shellshock testing service", or a site or other trustable body that would let me know if they're patched to current levels or not.

| improve this question | |
  • I suspect the downvote is because, though that site may stink of security vulns, this question (title at least) stinks of black hat ;). Reading the question more thoroughly it's probably not the case, but you might want to try to formulate it a bit less like "I see this really old website and want to exploit it" and more like "Someone claims their site to be certified secure, can I prove that it's not (e.g. shellshock?) without really hacking them?" – Luc Oct 1 '14 at 18:43
  • I didn't even think of it as a gray- or black-hat area until you mentioned it, thanks. I just want to know how to tell if I should trust this site. I would also like to be able to tell other people "check with ShellShockObservatory.com, they'll tell you if they're vulnerable or not." Such sites sprang up rapidly after Heartbleed, if I remember correctly. – John Deters Oct 1 '14 at 19:07
  • 1
    shellshocker.net maybe this helps – that guy from over there Oct 1 '14 at 21:55
6

With Heartbleed, a definitive scan is possible: ask for a heartbeat response that's one byte too large, and see if you get it; a negative result means that the server is not vulnerable. This tests the OpenSSL library directly, and performs exactly the same operations that an attacker would perform.

This isn't possible with "shellshock": the bash shell is never exposed directly to the Internet. Any scanning is indirect, calling a CGI program and seeing if the attack payload gets run, so a scan that returns a negative result could be because the server has been patched (not vulnerable), or because it uses a different system shell (maybe not vulnerable), or because none of the CGI programs calls bash (not vulnerable right now), or because the scan didn't try the right CGI program (vulnerable, but you don't know it).

| improve this answer | |
  • You can have a look at clues as to what the operating system is though (like in the "Server" HTTP header or using nmap) to see if it's likely an EOL no-longer-supported system. Not a definitive answer but a hint in a direction or another. – Stéphane Chazelas Oct 3 '14 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.