yeahforbes

Sorry, should've searched for previous thread located at https://news.ycombinator.com/item?id=9682312

Yeah, the entire script is horrifying. It's been a long time since I've seen malware source, especially targeting *nix.

In bash, function definitions can be exported via environment variables; in handling that bash also executes whatever immediately follows the function definition; Apache sets environment variables (without sanitizing them for the above) based on incoming HTTP request headers which are controlled by end user clients.

Because this functionality in bash predated Apache, it could be argued that Apache ought to perform sanitization before setting env vars from user input given that bash might execute it, but on the other hand bash's ability for data to be executed as code was pretty much undocumented and is now considered the bug.

Wikipedia has a good explanation at http://en.wikipedia.org/wiki/Shellshock_(software_bug)

I'm doing the same, and wondering to myself if that string is actually comprehensive. Are there variants, and if so can they be included as log search patterns without tons of false positives?

I've got lots of wget commands in there like guylhem noted, attempting to either drop a script (and clean up) or phone home to normal random websites that were unfortunately compromised. The phone home requests have all sorts of URIs containing things from my hostnames to unique IDs.

I would guess that for (m)any breaches that have occurred so far, the owner might not have even checked for evidence nor have the thieves bragged yet. Time will tell.

Excellent so far, although I've always thought of the entire interactive userland as the shell -- not only CLI, but also GUI, as each wraps the kernel on sort of the same plane.

I'd be interested in a source pointing out the origin of that obligation. I very much agree that end-to-end encryption is superior for transactions that need it. Some don't need it though, and MITM'd encryption does at least protect the end user from any untrusted parties on their local subnet like in coffee shops, which are far more untrusted than upstream operators.

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)