3 ms·

Keep in mind that you're reading a filtered, minimalist snippet of a probably very long and complicated case, and that whatever you're presuming from the articl

Keep in mind that you're reading a filtered, minimalist snippet of a probably very long and complicated case, and that whatever you're presuming from the article probably isn't the whole picture.

mzs 7y ago
¯\_(ツ)_/¯ > https://twitter.com/KimZetter/status/1218058408927973376 https://twitter.com/KimZetter/status/1218058408927973376 From the security experts affidavit filed in Georgia court today: 15. On December 2, 2014, while the KSU server remained vulnerable, a new user named "shellshock" was created on the server. I have created the below timeline of activity related to the shellshock user after fusing logging data from multiple sources. The timeline may not be complete: 16. 12/2/2014 10:45 — the user mpears09 is modified using the Webmin console 12/2/2014 10:47 - shellshock user created using Webmin console 12/2/2014 10:49 - /home/shellshock/.bash histovy last modified 12/22014 11:02 - /home/shellshocWshellsh0ck file is deleted 12/2/2014 1106 - bash patched to version 4.2+dfsg-0.1+deb7u3 to prevent shellshock 12/2/2014 11:40 - shellshock user disabled using Webmin console 17. The file "bash history" is a kind of log that typically records all the commands a user executes. For this user, though, the file contained a single command to logout of the server. The single command to logout is suspicious since a file was created and deleted in the user's home directory, leading rne to believe the "bash history" has been modified. This indicates to rne that the "shellshock" user may have been hiding their activities.
- peterwwillis 7y ago
  GP's comment was not about whether or not the server was attacked, please re-read.
- washadjeffmad 7y ago
  Odd, I might have concluded that mpears09 logged into webmin, created the shellshock user via that interface, ran or implemented some variation of the shellshock patch script[1] manually as that user, and maybe cleaned up when he disabled it. The actions also might not have been executed in a way that would have been logged. Whether maintenance of some aspect of the CES server was part of his role at KSU at the time or if records exist of someone asking him to do that (or, say, to patch drupalgeddon and he did a 2-for-1) is what I wonder. [1] https://github.com/tibmeister/ShellShock-Patch https://github.com/tibmeister/ShellShock-Patch

Keep in mind that you're reading a filtered, minimalist snippet of a probably very long and complicated case, and that whatever you're presuming from the article probably isn't the whole picture.

mzs 7y ago

¯\_(ツ)_/¯ > https://twitter.com/KimZetter/status/1218058408927973376 https://twitter.com/KimZetter/status/1218058408927973376 From the security experts affidavit filed in Georgia court today: 15. On December 2, 2014, while the KSU server remained vulnerable, a new user named "shellshock" was created on the server. I have created the below timeline of activity related to the shellshock user after fusing logging data from multiple sources. The timeline may not be complete: 16. 12/2/2014 10:45 — the user mpears09 is modified using the Webmin console 12/2/2014 10:47 - shellshock user created using Webmin console 12/2/2014 10:49 - /home/shellshock/.bash histovy last modified 12/22014 11:02 - /home/shellshocWshellsh0ck file is deleted 12/2/2014 1106 - bash patched to version 4.2+dfsg-0.1+deb7u3 to prevent shellshock 12/2/2014 11:40 - shellshock user disabled using Webmin console 17. The file "bash history" is a kind of log that typically records all the commands a user executes. For this user, though, the file contained a single command to logout of the server. The single command to logout is suspicious since a file was created and deleted in the user's home directory, leading rne to believe the "bash history" has been modified. This indicates to rne that the "shellshock" user may have been hiding their activities.

peterwwillis 7y ago
GP's comment was not about whether or not the server was attacked, please re-read.
washadjeffmad 7y ago
Odd, I might have concluded that mpears09 logged into webmin, created the shellshock user via that interface, ran or implemented some variation of the shellshock patch script[1] manually as that user, and maybe cleaned up when he disabled it. The actions also might not have been executed in a way that would have been logged. Whether maintenance of some aspect of the CES server was part of his role at KSU at the time or if records exist of someone asking him to do that (or, say, to patch drupalgeddon and he did a 2-for-1) is what I wonder. [1] https://github.com/tibmeister/ShellShock-Patch https://github.com/tibmeister/ShellShock-Patch