Shellshock - A BASH bug that effects Linux and Mac OSX ... and everyone on the web

Yeah, scaremongering isn't the best.  Luckily for those of us who run Linux, the fix is easy.

It also effects some Mac systems, although you will need to test and get your own upgrades.

It is possible that it effects Android systems as well.  I did the test on my tablet running CyanogenMod this morning and it was safe.  Your Mileage May Vary.

How this effects Windows is straightforward, it's another one of those low level things in a web server that can bite us later and since Linux powers many websites, you are effected indirectly.  Think of what the Heartbleed problem was and how you went in and changed all your passwords to protect yourself.  Good idea to start changing them again!

The bug is called "Shellshock".  The specifics is that it allows a ne'er do well to hack into an unpatched Linux server and gain full control via something called the BASH shell.  That is a bad thing because with control over bash, you can gain full control of the entire computer.

There is a test and full explanation of all the geekery under the hood here at this link at www.ArsTechnica.com if you care to dig deeper.  Basically, just go in and do a full update of your machine and make sure you see bash updated. 

The test is this line in terminal.

 env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If the system is vulnerable, the output will be:

vulnerable
 this is a test

An unaffected (or patched) system will output:

 bash: warning: x: ignoring function definition attempt
 bash: error importing function definition for `x'
 this is a test

Since Mac OSX is based on something called BSD and bash comes with it in their terminal.  If you have an older Mac that is acting as a server, look into a patch.

I personally did the fix last night on my Debian system while I was half asleep.  Really trivial to fix.

In a root terminal -

apt-get update
apt-get upgrade

It went out and updated my list of available updates, then upgraded those that needed it.  The package "bash" was included.

CentOS came up this morning with a bubble telling me to install updates.   It worked.  No problem.

I tried it out on my RaspberryPi machine and yes, that was affected.  The patch worked, and the picture is below. 

Here's the thing, it may effect Android tablets and phones depending on whether bash is installed.  It's a very basic and well known tool, so you will need to make sure you can patch the tablets. 

However, it's highly unlikely that some average dude walking down the street with a year old Android phone with an unpatched system will have a problem.  Someone would have to know you're there, get into your machine, and do the hack to gain control.  You aren't the person they would be looking for, it's that big web server sitting somewhere like a store or a bank that they're going to hack.

Just accept the updates if you have manual control of whatever computer you are using, phones and tablets included.

If you are "going into" your machine, set your update preferences to allow security updates automatically while you're at it since that makes it easier to administer the machines.

Testing an Eee PC with Ubuntu and CentOS Linux

I was handed an old Eee PC lately. One of those small netbook things.  I usually describe them as "Barbie's PC".  Personally anything with a keyboard is something better than without, but that's my preference.   Typing on a glass just does not have the feel of clicky or bouncy keys.

It didn't have an operating system.  So very helpful, turn the thing on and it told you that.  I'm assuming that the person who had it didn't want their data to be found, or it was one of the "refurbished" machines you see online. 

So here's what you do when you have a machine that "doesn't work at all".  You know, a dead machine that you want to see if it's intact or it needs to be recycled or you just have a machine with data on it you need to save before you start over.

Download a "Live CD" version of Linux.

They're a full operating system that just runs from the cd or the memory stick that you're using for the purpose.  You'll need at the bare minimum 1GB, but a 4GB stick is the most I have ever needed for the task.

They're an interesting thing.  In Windows and Mac machines, you're wedded to the computer.  With a Live CD and a little dancing, the PC becomes just a box that runs what's on the stick.  The stick doesn't care, it can run on any fairly modern machine.

The thing with these Live CDs is that they're completely independent of what's going on on your machine.  If you're off on vacation, you can have an environment that is tailored to your own use.  I've done that before, brought one with me.  Basically a complete computer on my keyring.  It only touches what is on the PC's hard drive if you go out of your way to do so.

Grabbing the most friendly Live CD, Ubuntu, I managed to get it to the memory stick using the instructions that are found on Ubuntu's site.  Plug that Memory Stick into the little Eee and power the thing on.  

I was presented with the Brown/Orange Ubuntu desktop.  Success.

Running through all the inventory of devices I managed to determine that the machine was complete, functional, intact, and ready for anything else I wanted to do with it.

After playing around and seeing that I was safe, I decided to click the helpful install icon on the desktop and let it go through the motions of a full install.  It worked beautifully.  At least the install did, but I eventually didn't go with Ubuntu for a couple reasons.

The Wifi on the install didn't work well.  I was constantly refreshing web pages that never loaded.  Since we're using computers both on the web and with programs on the hard drive, that wouldn't work.  Driver problems are the biggest problem with Linux.  It just isn't supported as well with "Cutting Edge" hardware.

The other thing is that Ubuntu is butt ugly.  They have something called the Unity Interface which is like having a permanently opened start menu on the left hand of the screen.  I couldn't figure out how to make it hide so I could ignore it.   This is the usual complaint.  I hate it and don't have to use it.

Luckily there are other versions that work as well, if not better in some cases.  For small computers, and older ones like the one that is probably sitting in the back of your closet, you'll want something called "Lubuntu".  Think of "Lightweight Ubuntu".  It uses an interface that looks very much like Windows, and runs blazingly fast because all the programs are the smaller ones.  On the Eee it ran beautifully except it had the same Wifi Problem.  If you don't have an Eee or you want to experiment with drivers, you may get it to work.  I was lazy, I had bandwidth and time.  I took the "Path of Least Resistance".

I eventually ended up installing CentOS which is a full server operating system.  This is the same thing that is running many websites and businesses around the world.  CentOS has a rock solid feel and an enormous amount of support since it is Red Hat Enterprise Linux, almost.  They took Red Hat, removed their branding, and put it out there for everyone to use free and since it is Linux it is all nice and legal.  I've never had a problem with CentOS, in fact since it is Linux, it runs on a very old machine with ease.  I had a 12 year old Pentium 3 laptop that had Centos 3 on it from back in the 1988 or so until it simply up and died one day.  Never had a problem with either CentOS or the ancient laptop at all and it ran as fast as the current hardware, going through update after update.

It just takes knowing what you're doing.  A lot of that experimentation has been removed with the mainstream Windows and Mac OSX.  Running Linux is a much more raw experience but when you have it up and running, it will purr like a kitten for years or even decades.