There's a new security bug in the news. It is called Shellshock, everyone is having a
bit of a panic about it, and no tech journalist seems to be trying to actually explain it
to the public. Which isn't surprising, because it's not the easiest thing to explain.
Here goes.
In the beginning, was the command line.
The command line is a way to give a computer instructions using text instead of clicking
or tapping. It's like having a text message conversation with your computer.
So I can issue a command to say, move this file here, or list what's running on this
system, or change my password, and it'll do it. Of course, it's incredibly literal-minded,
and while there are some safeguards built in, it is worth remembering that the command
for "delete absolutely everything, everywhere on this computer, yes, I'm absolutely sure"
is only eight characters long.
It isn't just a call-and-response thing. You can write programs with this. You can use
variables. So you can say 'hey, remember: in future, when I type X, I actually mean
this really long and complicated thing that I've put in quotes because I don't want to
have to retype it a hundred times. okay?' and it'll say 'ok', and later on you can just
type X.
That is where the bug is! Everything inside those quotes you see on screen should be treated
as simple text, and never, ever, ever as a command. That way you can pass it things from
the outside world without worrying they might do damage. It'll just be treated as text.
But in one of the most popular command line interfaces out there, Bash, if you type a
certain string of characters into the start of a variable, it trips up and it starts treating
it as a command line instruction instead.
Okay, that's a bug, but if you have to get someone to type a physical command in, that
is not exactly the best exploit in the world.
The trouble is: you don't have to get someone to type.
Because the command line is also a way for different programs to talk to each other.
Unix, the operating system that is the inspiration for what a lot of these modern servers run,
is based on the idea that rather than trying to rewrite code all the time, programs should
just call other, simpler programs. If you need to search through a file for certain
words, you don't write the code to do that yourself, it's been done for you, better,
probably: your own program uses the command line, quietly in the background, and look
at the output it gets sent back, quietly in the background. Never appears on screen, never
with text, but it's handled by the same shell, usually Bash.
Can you see where we're going? Because the program that serves you a web page will use
that Bash command line sometimes, to talk to other, smaller programs. Badly-written
web apps, probably things written in PHP, my favourite language of all, will use the
command line sometimes, it's really bad form, but they will. Embedded systems, things like
routers, maybe even small smart-home devices... they might just use the Bash command line,
because they trust it to be safe. But if the input from the world, the things from random
web users that they're sending to you, if they've been been maliciously crafted to include
that special string of characters... oh dear. Any person out there on the web might suddenly
be able to run very dangerous commands on your web server. You have what is known as
Remote Code Execution. Or being owned. Probably with a zero, because it's the internet. You
can almost certainly crash servers with that, you can probably do much worse damage. By
the time this video goes out, I'll be very surprised if someone hasn't crafted a clever,
self-replicating attack that's happily going round the world copying itself.
And the really bad news: that bug has been sitting, unnoticed, in Bash for about 25 years.
There is a hell of a lot of patching to do.
So that's how it works. The lesson for the end user? Make sure you keep your computer
and any servers you run up to date with patches and security fixes. There's not much you can
do about bugs like this, but you can try to keep up to date. As for those of you writing
code that's run 'near the metal', as they say, code that could actually be affected
by stuff like this, well, all I can say is: I really hope you're not taking your security
tips from some guy on YouTube.
[Translating these subtitles? Add your name here!]