@Simon Depends on which AWS product you're talking about, but in some cases (IaaS, where you're buying full VMs) you do have access to the OS for your VM, but in no case do you have access to the hypervisor (a customized version of Xen, IIRC) that the VMs are running on. And yeah, for a lot of services (like s3) you don't have access to the OS either, just the service that's running on top of it.
@TerryChia Why on earth would you even reply this? Of course it's a different exploit but it's still affecting bash and can possibly do the same damage. If they had found it earlier, they would have been able to push both fixes at the same time instead of having to release 2 different updates...
But anyway whatever, you're so clever, keep cleverin', your social skills are great.
The rest of the world is dumb, you're just awesome.
@ThomasPornin Did you proceed to call him an idiot and laugh at him because he's uneducated on the subject? I'm sure that's what @TerryChia would have done.
I don't think anyone can properly judge if a human-being is truly an idiot considering that you have no idea what he's gone through.
"Why would you do this? You're an idiot", perhaps the individual has lived experiences that you haven't, making you completely unable to properly judge.
But hey, let's just keep calling people idiots anyway.
@Simon Right, because tip toeing around every topic because of "maybes" is great for communication. If the person has reasons for it he is always welcomed to call me an idiot and argue his ideas.
@Simon Right, because you speak to people you know that way. Let me be clear, if I know someone well enough to respect the person I will be frank and that includes calling out stupidity when I see it. If I don't know the person I'll just ignore him.
For years, the GNU people have ranted that the proper name of the OS is not "Linux" but "GNU Linux" because this is the complete set of GNU tools (including the libc, the compiler...) over a Linux kernel.
@ThomasPornin fair argument I suppose, but then that same argument could be applied to most windows bugs as being in the periphery too vs core kernel if we really want to go down that route
In any case, Windows and Linux fanatics have mocked each other for decades, for every single security vulnerability which was discovered. Such mockery have never proven anything, except that the best jokes can grow old when repeated more than 200 times.
The point I would like to make out of this bug (and nobody will pay heed) is that shell scripts are structurally harmful for security.
4
(and that would also apply to Microsoft things like PowerShell)
It is not a new point; it has been made, by me and other people, for more than 20 years.
In older days, people were playing with the IFS environment variable, and file names with embedded newlines, and other such fun things.
TimC: Simply by setting the string as a user agent, or a cookie, or any number of CGI variables that would end up in the environment. From there, if the web page calls bash, like in a system call to execute an external command, the payload is ran. — Brendan Byrd4 hours ago
@ThomasPornin yeah, I agree, I just like it when Windows is proven to simply be a bigger target rather than inherently less secure. I don't think Windows is any more secure than Linux. I just like any brief reprieve from the Linux fanatic Windows detractors over stupid, ill-informed security complaints about Windows
@ThomasPornin yeah, but that is where the usability side comes in
any administrative tool is bad for security in some sense
and yes, I get that shell scripts are more powerful as they can do a lot at once and thus more of a risk
but people keep them because they have great utility as well
if someone can come up with a way that lets good people do things easily and keeps bad guys out all the time, they will become very rich
@AJHenderson I'd say it is not really a question of "doing a lot at once". It more is about shell languages to be based on string replacements and similar features. It encourages the kind of thinking that creates vulnerabilities (namely: implicit assumptions on the input data).
SQL injections are usually the result of programmer who just stuff external data in a string to be interpreted as SQL. The safe way would be prepared statement, or things like Linq (where the SQL syntax is separated from the data).
Scripting languages are heavy on the wrong side here.
right, but how do you build something that allows the simplicity of working from a command line with basic text files that doesn't have that limitation
If you want a "convenient", high level language where each statement does a lot of things, but still separates data from syntax, I suggest you take a look at Python.
@TRiG I must concur that it is slightly surprising: they chose some guy with several rings on his right hand, hair on the top of his hand, and (apparently) wearing some pyjama. This is not consistent with how stock photos are usually made.
If your server is compromised and the attacker is not a complete n00b, then the first thing he did was to clean the logs to remove any traces of his passage.
@RoryAlsop Sorry, I was referring to wifi-n networks.
I was kind of surprised to run a scanner and find no network at 5 GHz in my building, which is usually so full of access points that the network selection menu fills several times the height of my laptop
@ntrrgc Many access points will autonegotiate (ie 2.4 and 5 GHz are both allowed) - and generally the 2.4 will have much better signal strength, especially if there are lots of walls or the distances are long.
So 2.4 is the most common. Also lots of kit can't do 5 yet, so for compatibility, keeping your APs on 2.4 wins
