5 ms·
Why doesn't somebody update bash using the exploit?
So, why doesn't someone exploit bash to update bash. Might do the world a small favor. I was thinking that you could issue several commands to match a range of systems, and all it would take is one to work and then bash would be updated.
- nowarninglabel 12y agoThere was actually a great short story in 2600 a few years back about a security researcher using an exploit to create a worm that automatically patched up the vulnerable systems. Quite enjoyable, anyone remember the name of it?
- aroch 12y agohttps://en.wikipedia.org/wiki/Welchia https://en.wikipedia.org/wiki/Welchia
- runjake 12y agoBecause that's hacking and totally illegal in most countries. And this exact question was posted to Ask HN yesterday. Edit: It looks like yesterday's discussion was flagged out of existence.
- Prefinem 12y agoMy bad, I never saw it... Didn't realize it was ever posted
- Someone1234 12y agoBecause doing so would be illegal. And why go to jail, literally, for trying to fix other people's mistakes? Few have that little to lose. Plus companies would claim they spend $$$$ fixing the "damage" you did (e.g. reimage the machine, audits, management meetings about it). They'll claim they "spent" $50K or something stupid after your "illegal break-in" and try to sue you.
- Prefinem 12y agoI guess in today's world, even doing something helpful, the means that may not be "ethical" is seen as bad...
- smeyer 12y agoI certainly wouldn't consider this helpful. I'd rather decide when and if to undertake particular updates to my systems, not have someone else decide to try (and possibly fail) to force one on me in an ad hoc manner.
- stevekemp 12y agoAs the other commentators mention this would almost certainly be illegal, and would fall under computer-misuse laws. That said the more likely reason is that a lot of the time you couldn't - because the bash-you're exploiting wouldn't have root privileges and would thus be unable to fix the issue.
- Prefinem 12y agoAh... Thanks for the explanation... I haven't done a lot of research on it yet, just worked on updating bash to fix it.
- drivingmenuts 12y agoNot only would that be illegal, it would be nearly impossible, since you'd have to patch bash at the binary level. IIR, compiled software on Linux is non-deterministic, so you'd stand an amazingly high chance of damaging the targeted system as opposed to fixing it. So, if you could pull that one off, you'd not only be a god, but you'd be a god that would probably spend the rest of your life defending yourself in court, where ethics and justice are not really the point. Just let the process handle it. It's way simpler and far less likely to blow up.
- lutusp 12y ago> So, why doesn't someone exploit bash to update bash. Because each Bash version has different machine-language instructions. There's no realistic way to fix Bash other than by editing the plain-text source and generating binaries for each target processor type. > ... and all it would take is one to work and then bash would be updated. Maybe a refresher is indicated, as to the nature of modern computer binaries and how they're created.
- Prefinem 12y ago> Maybe a refresher is indicated, as to the nature of modern computer binaries and how they're created. I was assuming executing commands like "apt-get update bash", "yum update bash" etc to cover the majority of distros
- lutusp 12y agoBut it's both simpler and more effective to issue those commands directly -- they would either perform the update or benignly say that the current Bash version is up to date. And suppose a particular vulnerability test fails on a Bash version that is nonetheless vulnerable, and therefore fails to install a critical security update?