Regulators warn banks over 'Shellshock' bug that can take over computers

A group of top US financial regulators urged banks to quickly fix their software to protect it against the "Shellshock" computer bug, saying it could expose them to fraud.

Shellshock is a newly emerged major Internet threat that affects a common software tool found in many operating systems known as Bash, or Bourne-again Shell.

"The pervasive use of Bash and the potential for this vulnerability to be automated presents a material risk," the Federal Financial Institutions Examinations Council said.

The FFIEC is an interagency body that can prescribe common standards for banks that includes the Federal Reserve, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and others.

The banks should identify all their systems that use Bash and update them, and should also check third-party software, the group of regulators said. (Reporting by Douwe Miedema; Editing by David Gregorio)

Bash

"Shellshock" is the first major Internet threat to emerge since the discovery in April of "Heartbleed," which affected encryption software used in about two-thirds of all web servers, along with hundreds of technology products.

The latest bug has been compared to "Heartbleed" partly because the software at the heart of the "Shellshock" bug, known as Bash, is also widely used in web servers and other types of computer equipment.

According to security experts, "Shellshock" is unlikely to affect as many systems as "Heartbleed" because not all computers running Bash can be exploited. Still, they said the new bug has the potential to wreak more havoc because it enables hackers to gain complete control of an infected machine, which lets them destroy data, shut down networks or launch attacks on websites.

The "Heartbleed" bug only allowed hackers to steal data.

Patches coming out

The industry is rushing to determine which systems can be remotely compromised by hackers, but there are currently no estimates on the number of vulnerable systems.

Amazon.com Inc and Google Inc have released bulletins to advise web services customers how to protect themselves from the new cyber threat. A Google spokesman said the company is releasing software patches to fix the bug.

"We don't actually know how widespread this is. This is probably one of the most difficult-to-measure bugs that has come along in years," said Dan Kaminsky, a well-known expert on Internet threats.

For an attack to be successful, a targeted system must be accessible via the Internet and also running a second vulnerable set of code besides Bash, experts said.

"There is a lot of speculation out there as to what is vulnerable, but we just don't have the answers," said Marc Maiffret, chief technology officer of cybersecurity firm BeyondTrust. "This is going to unfold over the coming weeks and months."

Apple claims Mac users are mostly safe

Apple said the vast majority of Mac computer users are not at risk from the recently identified "Shellshock" computer bug, which security experts have warned affect operating systems, including Mac's OS X.

"The vast majority of OS X users are not at risk," Apple spokesman Bill Evans said late Thursday evening.

The bug does not appear to affect Apple's iOS, which is used on the iPhone and iPad, or machines running Microsoft Corp's Windows software.

Apple ships its computers so they are "safe by default," Evans said, which means that they are not vulnerable to remote attacks unless users configure them for "advanced" Unix services.

"We are working to quickly provide a software update for our advanced UNIX users," he said.

Attacks on devices

Joe Hancock, a cybersecurity expert with insurer AEGIS in London, said in a statement that he is concerned about the potential for attacks on home broadband routers and controllers used to manage critical infrastructure facilities.

"In some areas this will be a challenge to fix, as many embedded devices are not designed with regular updates in mind and will never be able to be patched," Hancock said.

HD Moore, chief research officer with security software maker Rapid7, said it could take weeks or even months to determine what impact the bug will have.

"At this point we don't know what we don't know, but we do expect to see additional exploit vectors surface as vendors and researchers start the assessment process for their products and services," Moore said in an email. "We are likely to see compromises as a result of this issue for years to come."

Linux makers released patches to protect against attacks on Wednesday, though security researchers uncovered flaws in those updates, prompting No. 1 Linux maker Red Hat Inc to advise customers that the patch was "incomplete."

"That's a problem. It's been a little over 24 hours and we're still in the same boat," said Mat Gangwer, lead security consultant at Rook Security. "People are kind of freaking out. Rightfully so."

Worms

Russian security software maker Kaspersky Lab reported that a computer worm has begun infecting computers by exploiting "Shellshock."

The malicious software can take control of an infected machine, launch denial-of-service attacks to disrupt websites, and also scan for other vulnerable devices, including routers, said Kaspersky researcher David Jacoby.

He said he did not know who was behind the attacks and could not name any victims.

Jaime Blasco, labs director at AlienVault, said he had uncovered the same piece of malware, as well as a second worm seeking to exploit "Shellshock," which was designed for launching denial of service attacks.

"Heartbleed" is a bug in an open-source encryption software called OpenSSL. The bug put the data of millions of people at risk, as OpenSSL is used in about two-thirds of all websites. It also forced dozens of technology companies to issue security patches for hundreds of products that use OpenSSL.