The Internet Is Broken, and Shellshock Is Just the Start of Our Woes
Brian Fox drove from Boston to Santa Barbara, with two tapes stashed in his trunk.
These werent music tapes or video tapes. They were computer tapestwo massive reels loaded with software code and data, the sort you can see spinning on furniture-sized computers in classic movies like Dr. Strangelove and Three Days of the Condor.
The year was 1987, and as Fox drove cross-country to his new home, the tapes held a software program called Bash, a tool that Fox had built for the UNIX operating system and tagged with a license that let anyone use the code and even redistribute it to others. Foxa high school dropout who spent his time hanging out with MIT computer geeks such as Richard Stallmanwas a foot soldier in an ambitious effort to create software that was free, hackable, and unencumbered by onerous copy restrictions. It was called the Free Software Movement, and the idea was to gradually rebuild all of the components of the UNIX operating system into a free product called GNU and share them with the world at large. It was the dawn of open source software.
Fox and Stallman didnt know it at the time, but they were building the tools that would become some of the most important pieces of our global communications infrastructure for decades to come. After Fox drove those tapes to California and went back to work on Bash, other engineers started using the software and even helped build it. And as UNIX gave rise to GNU and Linuxthe OS that drives so much of the modern internetBash found its way onto tens of thousands of machines. But somewhere along the way, in about 1992, one engineer typed a bug into the code. Last week, more then twenty years later, security researchers finally noticed this flaw in Foxs ancient program. They called it Shellshock, and they warned it could allow hackers to wreak havoc on the modern internet.
Shellshock is one of the oldest known and unpatched bugs in the history of computing. But its story isnt that unusual. Earlier this year, researchers discovered another massive internet bug, called Heartbleed, that had also languished in open source software for years. Both bugs are indicative of a problem that could continue to plague the internet unless we revamp the way we write and audit software. Because the net is built on software that gets endlessly used and reused, its littered with code that dates back decades, and some of it never gets audited for security bugs.
When Bash was built, no one thought to audit it for internet attacks because that didnt really make sense. Worrying about this being one of the most [used] pieces of software on the planet and then having malicious people attack it was just not a possibility, Fox says. By the time it became a possibility, it had been in use for 15 years. Today, its used by Google and Facebook and every other big name on the internet, and because the code is open source, any of them can audit it at any time. In fact, anyone on earth can audit it at anytime. But no one thought to. And that needs to change.
In digital terms, Foxs Bash program was about the same size as, say, a photograph snapped with your iPhone. But back in 1987, he couldnt email it across the country. The internet was only just getting off the ground. There was no world wide web, and the most efficient way to move that much data across the country was to put it in the trunk of a car.
Bash is a shell utility, a black-boxy way of interfacing with an operating system that predates the graphical user interface. If youve used Microsofts Windows command prompt, you get the idea. That may seem like an archaic thing, but as the internet took off, fueled by web browsers and the Apache web server, the Bash shell became a simple yet powerful way for engineers to glue web software to the operating system. Want your web server to get information from the computers files? Make it pop up a bash shell and run a series of commands. Thats how the web was builtscript by script.
Today, Bash is still an important part of the toolkit that helps power the web. Its on the Mac, and virtually any company that runs the Linux operating system, the descendant of UNIX, uses it as a quick and easy way to connect computer programsweb server software, for examplewith the underlying operating system.
But the lead developer of the program doesnt work for any of these big names. He doesnt even work for a tech company. His name is Chet Ramey, and hes a coder at Case Western Reserve University in Cleveland. He works on Bash in his spare time.
Read more from the original source:
The Internet Is Broken, and Shellshock Is Just the Start of Our Woes