1

There are lots of posts regarding the shellshock vulnerability. I can understand the vulnerability in detail.

However, I'm curious about why any Intrusion detection system or host-based tools (e.g., antivirus systems) fails to detect it?

Some answers may include Snort does not have the appropriate signature, but at least there should be some other symptoms that network administrators should understand something going on abnormal in their network such as HTTP user agent string differs (host-based solutions checks that right?), the outbound traffic may increase abnormally, or number of processes or memory usage increase at the webservers than usual boundaries.

PS: This question is about the webservers that are vulnerable to shellshock attack. I mean by in advance that after a short time the attack is attempted by the attacker.

Improve this question
3
  • Webservers are never vulnerable to shellshock, it's the bash binary on the server that is vulnerable, web servers are only one way the attacker can easily control environment variables on the server. Two identical web server and cgi script could be installed on two servers and have one vulnerable installation and one safe because one server had not patched bash.
    – wireghoul
    Commented Jan 14, 2015 at 19:12
  • Yes, you are right. I mean even it's a zero day attack, my goal is somehow predict the attack by means of some other symptoms that it can generate on my server.
    – berkay
    Commented Jan 14, 2015 at 20:11
  • attacks using the HTTP header vector are easily detectable. I posted snort signatures on 2014-09-20, 4 days before disclosure like alert tcp any any -> any $HTTP_PORTS (msg:"CVE-2014-6271 bashdoor exploit attempt over HTTP"; flow: to_server,established; content:"() {"; http_header; fast_pattern:only; classtype:web-application-attack; sid:1000000; rev:1;) there's no general pattern for successful attacks, though there can be for specific ones (like the ones that cause a wget to be run on the target).
    – Stéphane Chazelas
    Commented Jan 14, 2015 at 20:47

3 Answers 3

Reset to default
3

An antivirus solution will usually not detect it, because these programs only scan files. In case of the shellshock exploit, no files are written to the servers filesystem.

Depending on whether or not an intrusion detection system detects this attack depends on how uncommon the activity really is for the specific web application it is protecting, so there is no general answer for this.

Improve this answer
1
  • ok., so i understand that there is no way to detect it with the current security tools even when attacker tries to execute some bash scripts on my webserver. So that a careful administrator may understand by checking such as the mrtg outputs (cpu usage, number of system processes etc.) may at least came up with the suspicious behaviour.
    – berkay
    Commented Jan 14, 2015 at 20:10
3
  • The contents of a shellshock attack are technically valid web server requests. You could aggressively cull them (by looking for strings which could possibly be a shellshock attack and blocking them), but it would have limitations for legitimate applications (such as those which need to work with binary data that may happen to fit a shellshock signature).
  • There would be exactly as many detectable side effects as there would be. The actual attack would be virtually invisible in the noise, but you would see standard behavioral changes. However, in cases such as a APT with a competent attacker, you'll find that the attackers are well versed in what admins look for in network traffic and are willing to take their time, keeping their effects in the noise.
Improve this answer
1

The shellshock vulnerability is a bug found in bash.

  • Antivirus will not find it because it is not a virus (it is a bug in a program).
  • Intrusion Detection Systems (IDS's) will not usually detect a vulnerability such as this unless it is being actively exploited (e.g. an intrusion is happening). As indicated in other answers, an intrusion detection system might not even detect an intrusion if the attacker can make the traffic "look normal".

The way to mitigate this and other such vulnerabilities is to apply the latest security patches (e.g. yum update all) or set the system to automatically update. To fix the shellshock vulnerability, you need to update bash.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .