3 ms·

I imagine that there would be little need for a 0day. Also, if your setup allows you to be exploited via HTTP, chances are high that you're running old stuff an

I imagine that there would be little need for a 0day. Also, if your setup allows you to be exploited via HTTP, chances are high that you're running old stuff anyway. Somone is going to make a fortune mining bitcoin in the coming weeks.

patio11 12y ago
You could bot up every server at AmaGooBookSoft and still not make an appreciable amount of money mining Bitcoin, though I suppose that is not true if you go to one of the scrypt altcoins. CPU mining is very uncompetitive. A CPU miner is upper bounded at about 100 mega-hash per second (100 * 10^6 hashes) and more typically closer to 5 * 10^6. 100 megahash per second is worth approximately two cents per month. My off-the-cuff estimate for AmaGooBookSoft is 300k servers, which gets you about $6k a month or $200 a day if you rooted all of them and they were the most effective CPUs ever reported for mining Bitcoin. The far more likely way for this bug resulting in someone exfiltrating lots of bitcoins is them hitting every Bitcoin exchange looking for e.g. cPanel on a development box, Wordpress hosted on Nginx with fastcgi, etc etc. If they find one, they've got the hot wallet inside of five minutes later if it is on the same box, a bit more if it is somewhere else on the local network. (I've got to admit, the first thing I did after patching my boxes, to relax about the stress, was grepping Bitcoin Core for system calls. No obvious ones that I could see, for what it is worth.) If I can emphasize again, though: just because you don't engage in risky behaviors like e.g. transacting in bitcoins, doesn't mean your boxes are safe. Every. Server. On. The. Internet. Will be probed for a variety of exploits enabled by this vulnerability. There will be dozens of independently administered for loops probing for it within 24 hours.
- TheSisb2 12y ago
  How did you patch your boxes? From my understanding there are still no patches.
  - yourad_io 12y ago
    I believe you are mistaken (unless you aren't talking about 'shellshock'). A patch was available almost immediately from most major distros. https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.2 https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.2 > -- Marc Deslauriers <email address hidden> Mon, 22 Sep 2014 15:31:07 -0400 Also, very amusing: > bash (4.2-2ubuntu2.2) precise-security; urgency=medium urgency=medium? Shouldn't it be: urgency="don't even finish your lunch; run"
    - fragmede 12y ago
      The fix for CVE-2014-6271 (shellshock) was incomplete, resulting in CVE-2014-7169 to track a better fix. CVE-2014-7169 has not been yet been patched.
      - yourad_io 12y ago
        You are correct, just spotted that myself. Excellent news all around.
    - antocv 12y ago
      That patch doesnt fix the whole issue. The fix right now is to mv bash ohhellnobarsh && ln -s dash sh Or such.
- harryh 12y ago
  FWIW your off the cuff estimate for AmaGooBookSoft servers is off by an order of magnitude (possibly 2 orders if you're talking about all 4 companies combined).
seanp2k2 12y ago
This affects current systems which were up-to-date before yesterday, so I question your assertion that this only affects older systems.

patio11 12y ago

You could bot up every server at AmaGooBookSoft and still not make an appreciable amount of money mining Bitcoin, though I suppose that is not true if you go to one of the scrypt altcoins. CPU mining is very uncompetitive. A CPU miner is upper bounded at about 100 mega-hash per second (100 * 10^6 hashes) and more typically closer to 5 * 10^6. 100 megahash per second is worth approximately two cents per month. My off-the-cuff estimate for AmaGooBookSoft is 300k servers, which gets you about $6k a month or $200 a day if you rooted all of them and they were the most effective CPUs ever reported for mining Bitcoin. The far more likely way for this bug resulting in someone exfiltrating lots of bitcoins is them hitting every Bitcoin exchange looking for e.g. cPanel on a development box, Wordpress hosted on Nginx with fastcgi, etc etc. If they find one, they've got the hot wallet inside of five minutes later if it is on the same box, a bit more if it is somewhere else on the local network. (I've got to admit, the first thing I did after patching my boxes, to relax about the stress, was grepping Bitcoin Core for system calls. No obvious ones that I could see, for what it is worth.) If I can emphasize again, though: just because you don't engage in risky behaviors like e.g. transacting in bitcoins, doesn't mean your boxes are safe. Every. Server. On. The. Internet. Will be probed for a variety of exploits enabled by this vulnerability. There will be dozens of independently administered for loops probing for it within 24 hours.

TheSisb2 12y ago
How did you patch your boxes? From my understanding there are still no patches.
- yourad_io 12y ago
  I believe you are mistaken (unless you aren't talking about 'shellshock'). A patch was available almost immediately from most major distros. https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.2 https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.2 > -- Marc Deslauriers <email address hidden> Mon, 22 Sep 2014 15:31:07 -0400 Also, very amusing: > bash (4.2-2ubuntu2.2) precise-security; urgency=medium urgency=medium? Shouldn't it be: urgency="don't even finish your lunch; run"
  - fragmede 12y ago
    The fix for CVE-2014-6271 (shellshock) was incomplete, resulting in CVE-2014-7169 to track a better fix. CVE-2014-7169 has not been yet been patched.
    - yourad_io 12y ago
      You are correct, just spotted that myself. Excellent news all around.
  - antocv 12y ago
    That patch doesnt fix the whole issue. The fix right now is to mv bash ohhellnobarsh && ln -s dash sh Or such.
harryh 12y ago
FWIW your off the cuff estimate for AmaGooBookSoft servers is off by an order of magnitude (possibly 2 orders if you're talking about all 4 companies combined).

seanp2k2 12y ago

This affects current systems which were up-to-date before yesterday, so I question your assertion that this only affects older systems.