Hackers exploits Shellshock flaw, may infect many computers

The Bash bug, also known as ‘Shellshock’, is a flaw in a piece of software known as ‘Bash’ that runs the command prompt on many computers.As damage from the bug spreads, many of the early patches designed to safeguard computers are proving ineffective.  “That’s a problem. It’s been a little over 24 hours and we’re […]

The Bash bug, also known as ‘Shellshock’, is a flaw in a piece of software known as ‘Bash’ that runs the command prompt on many computers.
As damage from the bug spreads, many of the early patches designed to safeguard computers are proving ineffective.  
“That’s a problem. It’s been a little over 24 hours and we’re still in the same boat,” said Mat Gangwer, lead security consultant at Rook Security.
“People are kind of freaking out. Rightfully so.”
Expert Richard Stiennon wrote that the code could quickly create a “SQL Slammer type internet meltdown.”
 This was a specific kind of attack that targeted the web’s infastructure and caused it slow significantly in 2003.
This includes Linux, which is used in everything from cars to cameras, as well as the Raspberry Pi, and the bug could also affect Android, Windows and IBM machines.
All Apple’s Mac OS X are also affected, as well as around half of all websites, security experts claim.
Hackers are already using massive internet scans to find vulnerable servers to attack, according to Robert Graham of Errata Security, writing In a blog post last week.
In a test, Mr Graham ran a IP scan and found 3,000 vulnerable systems before the scan crashed.
Just a few hours later, Mr Graham found that someone was already using his method to attack computers.
The bug makes all Apple Mac computers, around half of all websites and most internet connected home appliances vulnerable.
The danger is that it can run in the background, without a user ever knowing. And once it does, a hacker will be able to take control of your device.
For instance, the bug could be used to read or send emails, copy banking data, turn on a webcam or listen in on a computer’s microphone.
Essentially, this means if your computer will do something without asking for a password, then someone using the bug can also do the same.
Anyone using these devices will need to include a ‘patch’ update to the software as soon as it is released. As well as computers, the public is being warned they may need to update their internet-connected devices, such as smart locks, separately.  
“Someone is using mass scan to deliver malware,” Mr Graham wrote in an update. “They’ll likely have compromised most of the systems I’ve found by tomorrow morning.”