Timeline for Block Shellshock/Bashdoor with htaccess?
Current License: CC BY-SA 3.0
26 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Jun 28, 2015 at 14:05 | history | suggested | grg | CC BY-SA 3.0 |
edited title, copy edited
|
| Jun 28, 2015 at 8:32 | review | Suggested edits | |||
| S Jun 28, 2015 at 14:05 | |||||
| Jun 27, 2015 at 5:16 | comment | added | user49378 | My site appears secure for now - Thanks for all the advice 8) | |
| Jun 27, 2015 at 5:00 | answer | added | Mike -- No longer here | timeline score: 1 | |
| Jun 27, 2015 at 2:21 | comment | added | closetnoc | I am not sure how effective the above linked code is, but it is a start if you want to try it. I let these attack go on my site knowing that nothing would happen. Again, I think I would blocks IPs first. This probably will not last too long if you are annoyed enough anything you do could be temporary. | |
| Jun 27, 2015 at 2:18 | comment | added | user49378 | Good for now... | |
| Jun 27, 2015 at 2:18 | comment | added | user49378 | Funny I found that same site earlier today... My site is NOT on CMS 8) | |
| Jun 27, 2015 at 2:16 | comment | added | closetnoc | All good then?? | |
| Jun 27, 2015 at 2:15 | comment | added | user49378 | I ran the bash test - 8) | |
| Jun 27, 2015 at 2:13 | comment | added | closetnoc | I found this: skepticism.us/2015/04/… There are some .htaccess rules here. There may be more... but it seems that this is not a hot issue if patched. | |
| Jun 27, 2015 at 2:07 | comment | added | user49378 | That is why deny 46 is there 8); but some buggers were getting through somehow. That's why my old hotlinking code went back up. It's better to block a few innocents in this case... | |
| Jun 27, 2015 at 2:00 | comment | added | closetnoc | Okay. I would call tech support for your host quickly. I am sure they will tell you you are fine... otherwise, I would be changing hosts quickly!! ;-) Meanwhile, if you are not vulnerable, I would only try and block these if they really really annoy you. Even then, it may be better to block on IP addresses rather than chase blocking by terms found in the agent string. Doing a search. | |
| Jun 27, 2015 at 1:56 | comment | added | user49378 | No T'access & I'm not sure about trusting brandon potter although he is using Microsoft Corp network... | |
| Jun 27, 2015 at 1:52 | comment | added | closetnoc | You can check your OS version against a simple Google search such as this one shellshock ubuntu version. | |
| Jun 27, 2015 at 1:51 | comment | added | closetnoc | Huh. There is this: shellshock.brandonpotter.com Scary warning on this one. As well, you can check to see if the OS version has the updated bash. Some OSs had the bash fixed update. One other thing is to simply check with your hosts tech support. I rather suspect you are okay since this was such a HUGE vulnerability. Still, you want to check. | |
| Jun 27, 2015 at 1:41 | comment | added | user49378 | simple cut-n-paste | |
| Jun 27, 2015 at 1:38 | comment | added | closetnoc | Are you running a control panel that gives you terminal access? | |
| Jun 27, 2015 at 1:37 | comment | added | closetnoc | I wonder how you can check the version of bash then? Huh. | |
| Jun 27, 2015 at 1:35 | comment | added | user49378 | my site does not use SSH | |
| Jun 27, 2015 at 1:32 | comment | added | closetnoc | These are bash vulnerabilities. You would check them in a bash session through shell (SSH). Please know that bash is compiled into so much code, the system can be vulnerable is soooooo many ways that it is just a matter of time- not just Apache- though that is a common way in. | |
| Jun 27, 2015 at 1:24 | comment | added | user49378 | I was forbidden 8) I changed my Hotlinking code back to RewriteCond from SetEnvIfNoCase for a Whitelisted no-hotlinking.gif may have made the difference? | |
| Jun 27, 2015 at 1:10 | comment | added | closetnoc | Check out en.wikipedia.org/wiki/Shellshock_(software_bug) and pay attention to the CVE notices half way down. There are some tests you can run to know. You will want to check this. This is something that if not fixed right away you will not only get hacked in the worst way, but possibly destroyed. | |
| Jun 27, 2015 at 1:05 | comment | added | user49378 | I don't know? I tracked down what /?x=() was & scoured for htaccess code unsuccessfully. | |
| Jun 27, 2015 at 0:22 | comment | added | closetnoc | Are you vulnerable?? | |
| Jun 26, 2015 at 20:51 | history | edited | user49378 | CC BY-SA 3.0 |
deleted 3 characters in body
|
| Jun 26, 2015 at 20:44 | history | asked | user49378 | CC BY-SA 3.0 |