Hacker News Reader

Comment by pavs | Hacker News Reader

I have some vps with digitalocean, I haven't logged in to them in a long time, even after shellshock surfaced publicly. about aftter a month later I checked to see if I am vulnerable through shellshocker.net test and it was negative. I am guessing my provider did something to fix it.

View on HN

Maybe somebody other did close the vulnerabilty for you. Maybe the same guy who is lending your server for DDOS attacks now.

> ... vps with digitalocean ... I am guessing my provider did something to fix it.

I don't think DO offers any managed service. They wouldn't do anything to fix your servers. It's entirely on you to keep them updated.

Edit: https://www.digitalocean.com/help/policy/ <- they really don't offer it

I know they dont, I didn't say they do. But my non up-to-date Ubuntu server wasn't vulnerable when I checked about a month after shellshock vulnerable went public.

Have you considered you may be using a software stack that is not (obviously) vulnerable? Not every software is vulnerable by default on all URLs, just the ones that wind up calling out to bash in a specific way.

If I am not wrong the vulnerability test on shellshocker.net tests bash directly. Either way I could very well be wrong and I might have missed something.

Did you run the system test from the website?

https://shellshocker.net/#systemtest

Yes that's the one I was talking about. Ran the test before and after updating. It was the same (negative). I ran the same test on the relative up todate home computer (Ubuntu) and it was vulnerable on some of the tests. This IS weird.

No, you would need a vulnerable service running on the VPS in order to exploit it.

The scary possibility is that someone hacked you, backdoored the server, and then patched the vulnerability to keep others out.

So somebody used shellshock to break in, then plugged the hole to prevent others from accessing the server, and is now using your server for... whatever?

Ubuntu, for instance, has unattended-upgrade (that it defaults to on), the premise being that it will forcefully install and use critical security patches. Ideally you'd have done this yourself ASAP, but if not I have to think that unattended-upgrade came into play at some point.

That must be it. I can't think of any other way it could be patched. I didn't know about unattended-upgrade before.

unattended-upgrade in default mode does _not_ update anything. Neither on Ubuntu, Debian or any other distribution.

Default means "the default when you install Ubuntu", not the unconfigured state of that process. For kernel and in-use things it would still require a restart, however maybe at some point DO forced a restart, even if unrelated.

Reply on news.ycombinator.com