Azernews.Az

bY Bloomberg

Hackers are bombarding computers to test whether they're vulnerable to the Shellshock security hole that had lain dormant for two decades until last week, sparking a race by companies to protect their data.

Researchers who set up bait computers to monitor attacks said hackers almost immediately began planting malicious software that would allow them to create networks of infected computers. Network security company CloudFlare Inc. said it's tracked about 1.5 million attempts and test probes each day.

"They're doing a first round of reconnaissance and we're waiting to see if they come back later and do a round of targeted attacks," said Jason Trost, director of research for ThreatStream, a computer security company also monitoring the activity. "I would guess it will be within a week or two."

Software makers like Red Hat Inc. are implementing patches for a piece of software called Bash, one of the most widely installed programs on Linux systems and the main technology affected by Shellshock. Companies including Apple Inc. have incorporated the open-source program into their products, meaning a hole could leave millions of computers and devices vulnerable in an instant.

"There are probably a bunch of services and devices" at risk, said Jaime Blasco, the director of AlienVault Labs, who also helped arrange a project to bait hackers with so-called honeypots. "In the next few days and weeks we'll see more as people start finding out which other devices and software are vulnerable."

Heartbleed Window

The "vast majority" of Apple OS X users aren't at risk, Ryan James, a spokesman, said in an e-mail. The company issued three new patches yesterday for users of advanced OS X products.

While some patches have been released, it can still take companies weeks to implement the fixes, giving hackers a window of opportunity to carry out successful attacks. Chinese hackers earlier this year exploited the Heartbleed Web-security flaw at Community Health Systems Inc. in the time it took the company to implement a patch. The attack led to the theft of data for 4.5 million patients

If hackers are doing Shellshock reconnaissance, a new wave of sophisticated and targeted attacks could be coming, network security company FireEye Inc. warned on its blog.

Shellshock, publicly disclosed on Sept. 24, allows attackers to insert extra code into Unix-based computers through the Bash software. Some of the attacks detected through the honeypots set up by researchers attempted to make servers part of a botnet, which are used to steal data and launch attacks against other computers. One malware variant, however was aimed at giving hackers remote access to a computer, Trost said.

Sloppy Attacks

"We've seen hundreds of attacks come in," Trost said in a phone interview.

The attacks came from countries including Russia, China, the U.S., Singapore and Canada, Trost said. None of the attacks appeared to come from foreign governments because they were relatively simple and in some cases used sloppily-written code, he said.

Another honeypot set up shortly after Shellshock was announced drew incursions from hundreds of different computers in the first 24 hours and more than 1,000 in the six days it has been live, according to Blasco of AlienVault Labs.

In one case, the attackers tried to use the honeypot as part of a distributed denial of service attack against the online file-sharing site Pastebin, Blasco said. Those types of attacks are intended to knock company servers offline with a flood of Internet traffic. Pastebin representatives didn't immediately return an e-mail seeking comment.

Shiny Thing

The attackers appeared unsophisticated, seeking to test as many computers as possible without regard to who owned them. Some of the devices infected included Voice over Internet Protocol, or VoIP, phones, Blasco said.

"The problem is they are not that smart - they are launching these attacks but not in a smart way," he said.

The 1.5 million daily attempts to infect or probe servers tracked by CloudFlare came from multiple countries, including China, Russia and the U.S., said John Graham-Cumming, lead computer programmer for the San Francisco-based company.

"It's the new shiny thing," Graham-Cumming said in a phone interview. "There seems to be people who are just kicking the tires and trying to see if they might be able to break in."