“不小心”看到了[shellshock bash bug](What is the Shellshock Bash bug and why does it matter?)

\$env x='() { :;}; echo vulnerable' bash -c 'echo this is a test'


If you see the word “vulnerable” as an answer, your system is, well… vulnerable.

Your Bash shell is simply running more code after a function (the “() { :;};” part), and that shouldn’t be happening. The function is the “allowed” code, while everything after it is where the potentially “malicious” code could be installed.

##WHAT CAN AN ATTACKER DO?

The remote execution (over the internet or a network) of extra code could let an attacker load malware on a system and steal private information, delete files, activate your camera, open a lock and, well, do pretty much anything with a little know-how. However, as we mentioned, this is not something that should matter much on a user’s computer with a working firewall, because it hasn’t been proven possible to take advantage of the bug under that scenario.

A server, well, that’s a completely different story, because a server has to listen to requests in order to “serve” (pun intended) its purpose. This means that by requesting almost any data and running malicious code, an attacker can infect any affected server, which is about 60 percent of web servers out on the internet, most routers (even your home router) and many consumer devices (including security cameras and “smart” appliances – which don’t seem so smart right about now). This is because smart appliances are a form of servers.

The bottom line is: this is a serious bug, but patches are available and should be installed promptly. But, there’s no doubt we’ll be hearing plenty more about Shellshock and the problems it can cause in the coming days and weeks – especially since it’s gone unnoticed for around 25 years. There’s a lot of holes out there to patch.