History and stories
Shellshock: an old bug in the internet's plumbing
The flaw was in Bash, a program so basic that most people never knew their devices were running it.
1 min readStory
The short version
In 2014, researchers found a flaw in a basic tool used by countless servers and devices. Attacks started within hours of the announcement.
The story
Bash is a program that runs commands on Linux and Unix systems, including many web servers, routers and other network devices. On September 12, 2014, a researcher named Stéphane Chazelas told Bash’s maintainer that he had found a serious flaw. Under certain conditions, an attacker could make Bash run commands of their choosing, sometimes just by sending a specially crafted request to a web server.
The flaw had been in Bash for many years. A fix was prepared quietly, and the problem was announced on September 24, 2014, when updates were ready.
Attackers moved fast. Within hours of the announcement, they were scanning the internet for vulnerable systems and taking over computers to use in attacks. Several related flaws were found in the days that followed, each needing another fix.
Why it mattered
Shellshock showed how quickly attackers move once a flaw is announced: scanning began within hours. It also showed how many devices quietly run the same old software inside, from web servers to routers, and how hard it is to find and update them all.
The lesson today
Once a flaw is announced, the race is on between people applying the fix and people using it. Servers are often patched quickly. Routers, firewalls, storage boxes and other appliances are easier to forget. Every device needs to be on someone’s list for updates.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.