Are you Vulnerable to a breach due to the “Shellshock" bug?
The “Shellshock" Bash vulnerability is a serious information security issue . It is a powerful attack affecting businesses of all sizes and industries. Digital Defense, Inc. (DDI) has teams of vulnerability researchers and personal security analysts addressing concerns, mitigating risk and answering commonly asked questions.
Q: What is the “Shellshock” Bash Vulnerability?
A: The “Shellshock” Bash Vulnerability is a flaw in the Bash shell typically utilized by Linux based systems that allows an attacker to execute arbitrary commands on vulnerable hosts. The nature of this flaw is that it often allows for remote attackers to take control of a company's externally facing Webservers and VPN servers.
Q: What is Bash?
A: Bash is a command shell in linux/unix operating systems. Because it is such a core component many linux and unix based webservers / vpn servers / and email systems use it to carry out various tasks; the vulnerability in bash shell puts all these systems at risk to be hijacked by remote attackers.
Q: What types of systems are affected by “Shellshock” Bash?
A: Webservers and VPN servers are the primary systems at risk due to their externally facing nature; but almost all Linux/Unix systems and network appliances may be affected.
Q: Can DDI test for the vulnerability associated with “Shellshock” Bash vulnerability?
A: Yes! The Digital Defense Vulnerability Research team has developed a vulnerability test specifically for the issue and the test is available in the Frontline portal for client use. The test can be run as a single vulnerability test or as part of the full suite of tests.
Q: Why is DDI’s test more effective than those available for free on the internet?
A: Because the traffic pattern needed to completely test for this vulnerability require complex web-spidering and testing of all cgi-enabled pages, a commercial scanning solution is required. Almost everyone who has created a free-network-test has admitted that these sorts of single-probe tests for Shellshock are incomplete and often will false negative.
Another important factor to consider is that the free tools do not provide any level of support. As such, if you find that you have a system that is vulnerable to “Shellshock” Bug, you may have to do your own research or work with the vendor providing the system yourself to have the matter resolved. DDI clients are provided multiple levels of support, up to and including access to our vulnerability researchers and Personal Security Analysts (PSAs). This unprecedented level of support ensures that the business can secure their systems quickly and with greater assurance of accuracy implementing remediation efforts that positively impact the security of the system.
Q: What can a business do if they want to learn more about “Shellshock” Bug and how DDI can assist them in addressing the issue?
A: If you are concerned about being a victim of this attack, we can help. DDI can help your organization through proven methodology that reduces risk and secures information and intellectual property. To learn more, contact us at 888.983.5060
Need More In-Depth Info?
Contact us and one of our experts can help with any of our cybersecurity solutions.