Why Shellshock Remains a Cybersecurity Threat After 9 Years

The Shellshock vulnerability got a lot of attention when it was first disclosed in 2014 — both from the media and security teams. While that attention has waned in subsequent years, the Shellshock vulnerability has not disappeared — nor has attacker attention weakened.

Rather, this vulnerability remains a popular target, particularly in financial services applications. In fact, earlier this year, ThreatX identified attackers attempting to exploit a Shellshock vulnerability in approximately one-third of our customers. These numbers are concerning when considering the severity and age of this vulnerability. How could a vulnerability disclosed nine years ago still be so prevalent in attacks? And why do so many credit unions fall victim?

What Is Shellshock and Why Does It Still Exist?

Shellshock, also known as the Bash bug or CVE-2014-6271, is a vulnerability that researchers discovered in September 2014 in the Unix Bash shell. Deemed a critical vulnerability due to the escalated privileges it provides attackers if exploited, Shellshock existed on billions of devices around the world and caused widespread panic and countless patches in 2014. The panic has subsided, but the vulnerability hasn't exactly gone away. It still exists in the wild and remains popular because it is relatively simple to launch and deploy and requires little skill or cost from an attacker.

So why does it still exist nearly 10 years later? Three words: bad patch management. Failure to apply patches in a timely manner can leave organizations vulnerable to attacks that exploit known vulnerabilities. The Shellshock vulnerability is a prime example of the consequences of not applying patches promptly. Many organizations are slow to apply the necessary updates, leaving their systems open to attack.

One reason organizations are struggling with patch management is because the process can be complex and time-consuming, especially in large or distributed environments. There may also be concerns about the potential impact of applying patches, such as downtime or compatibility issues with other software. Additionally, some organizations may not have the necessary resources or expertise to effectively manage patching across their entire infrastructure.

How are attackers using Shellshock? Often, they are using it to launch distributed denial of service (DDoS) attacks and to target vulnerable systems that are interconnected. These attacks are usually deployed using bots and botnets. Additionally, attackers historically have targeted the flaw on some network storage devices to dump all the data they're storing or even target cryptocurrency.

Why Are Credit Unions a Primary Target for Attackers?

While attackers aren't attacking only credit unions with this vulnerability, ThreatX has seen a higher proportion of these types of attacks against our credit union customers than our other customers. For 33% of our credit union customers, Shellshock was a top-4 attack type targeting them in a four-week period in 2023.

Credit unions are prime targets not just for Shellshock but for cyberattacks in general. They make attractive targets primarily because they hold a significant amount of sensitive financial information, including personal data. Second, credit unions have historically lacked the security resources of larger financial and banking institutions with huge budgets and security teams. They are often seen as a softer or easier target due to the lack of defenses or personnel, and attackers may assume they are behind in patching.

Third-party supply chain risks can be higher with these organizations as well. Credit unions often rely on third-party vendors for access to online banking, mobile banking, and payment processing. Not all vendors are applying the same or "just as good as" security controls that leave everyone vulnerable and at risk.

How Can You Prepare Your Systems Against Shellshock?

To properly defend and protect your systems from potential attacks, organizations need to keep systems patched and protect against bots.

Optimize Patch Processes

Establish a robust patch management policy and process, including regular vulnerability scanning and prioritizing critical patches. Also, ensure that all systems and software are properly configured to receive and apply patches automatically, where and when possible. Training and education for staff on patch management best practices and the importance of timely patching is also critically important. Finally, organizations should regularly review and update their patch management strategy to ensure it remains effective in the face of evolving threats and technologies.

Shore Up Bot Defense

Most attacks against application programming interfaces (APIs) and applications, including those related to Shellshock, now leverage bots or botnets. The challenge with mitigating bot traffic is that not all bots are malicious (think search engine spiders). Coarse-grained bot mitigation efforts can disrupt or degrade legitimate user experience. It's long been known that the use of CAPTCHA to identify humans vs. bots leads to a suboptimal customer experience. Advanced bots may also use headless browsers or impersonate legitimate users, which can easily defeat user-agent based detection and fool web application firewalls and web applications into thinking the attacking bots are, in fact, a normal human user.

Real-time behavioral profiling and threat engagement techniques are critical to effective bot mitigation. Behavioral profiling looks at large volumes of contextual data, monitoring every request live from every user to characterize their behavior and map their intent. By seeing more transactions, the system can recognize a broader pattern much faster and automatically craft a complex behavioral signature to block the attack in real time. In addition to behavioral profiling, advanced threat engagement techniques, such as IP fingerprinting, interrogation, and tarpitting, help shed light on the "user's" intent.

Take a Proactive Approach

While the Shellshock vulnerability may still be active for many years to come, the best way to protect yourself and organizations is to implement proper patch management into security plans and ensure that your bot defenses are optimized. Cybercriminals are getting smarter, and the next Shellshock may be on its way. But if you take a proactive approach to your security, you won't be scrambling to implement quick fixes.