Be Aware and Be Prepared
I am betting most of you have heard about the recent “Shellshock Bash Bug”. If not, here is why you should care – this bug has affected users of Bash, which is one of the most popular utilities installed on operating systems today. Discovered in early September 2014, this extremely severe bug affects bash versions dating back to version 1.13 and has the ability to process shell commands after function definitions in Bash that exposes systems to security threats. This vulnerability allows remote attackers to execute any shell command and gain access to internal data, publish malicious code, reconfigure environments and exploit systems in infinite ways.
Shellshock Bash Bug Free, Safe and Secure
None of the Sumo Logic service components were impacted due to the innate design of our systems. However, for those of you out there who might have fallen victim to this bug based on your system architecture, you’ll want to jump in quickly to address potential vulnerabilities.
What We Can Do for You
If you have been searching around for a tool to expedite the process of identifying potential attacks on your systems, you’re in the right place! I recommend that you consider Sumo Logic and especially our pattern recognition capability called LogReduce. Here is how it works – the search feature enables you to search for the well known “() {“ Shellshock indicators while the touch of the LogReduce button effectively returns potential malicious activity for you to consider. Take for instance a large group of messages that could be a typical series of ping requests, LogReduce separates messages by their distinct signatures making it easier for you to review those that differ from the norm. You can easily see instances of scans, attempts and real attacks separated into distinct groups. This feature streamlines your investigation process to uncover abnormalities and potential attacks. Give it a try and see for yourself how LogReduce can reveal to you a broad range of remote attacker activity from downloads of malicious files to your systems, to internal file dumps for external retrieval, and many others.
