First it was Heartbleed, now it’s Shellshock. Two vulnerabilities affecting many of the planet’s web users have hit widely deployed free and open source software in a matter of months.

Heartbleed brought about distrust in OpenSSL, which was designed to make websites more secure but instead opened them up to attack.

Earlier this week, Shellshock landed, allowing hackers to easily exploit many web servers that used the free and open source Bash command line shell, managed by the GNU Project.

Malicious types are now trying to exploit the flaw en masse as attempts to close off the vulnerability have failed and critics have called for greater controls over open source software, though GNU Project founder Richard Stallman told the Guardian that Shellshock will soon be deemed by the world as only “a blip”.

Bash exploits have thus far tried to place at least two different kinds of malware on vulnerable web servers, both of which seem to be creating armies of bots for future Distributed Denial of Service attacks, which typically flood website networks with traffic to take them offline, security experts have warned.

As many as 715 users, most likely victims, connected to a server controlling one of the malware variants, noted Jaime Blasco, director of AlienVault Labs. Romanian cybercriminals appear to be in control of that server, he added.

There are indications Shellshock is considerably more prevalent than initially predicted too. “Right now people are pretty much falling over themselves trying to come up with the craziest attack vector possible,” said security expert Andreas Lindh, who successfully exploited his own Buffalo Linkstation Network Attached Storage (NAS) device using the Bash bug.

The vulnerability was supposed to only affect those machines that ran Bash as their default command line interface, but mounting evidence has hinted even those using related interpreters could be exploited.

Lindh’s NAS ran Bash alternative Dash by default and a tweet from security researcher Dragos Ruiu appeared to back up Lindh’s early research. If derivatives of Bash are also vulnerable to Shellshock, this would widen the number of potential targets massively.

“We should probably not make big a fuss about that just yet, but if it turns out that some old Dash shells are also vulnerable, then consumer appliances will definitely be at risk,” Lindh added.

Bashing the Bash creator

Fingers have now pointed to the GNU Project, which spawned Bash. Critics have noted only one person has been given the job of maintaining and updating Bash, though all developers are invited to contribute to the code.

More controls are now needed to ensure future Heartbleeds and Shellshocks don’t send the world into a frenzy, they’ve argued.

“The open source fans all say that it is the best approach as anyone can check the code. Sadly it doesn’t happen like that it practice as it gets forgotten about (this problem could be 25 years old) and a lot of the older code is written in opaque languages like C, not to mention not being well structured,” said Professor Alan Woodward, security expert from the Department of Computing at the University of Surrey.

“It’s like trying to untangle 25-year-old spaghetti so not surprising it is never checked that often. These flaws are being found most often when someone notices an effect, not because they are trawling through the code.

“It is a problem and needs to be addressed or there will be more of these legacy issues come back to bite us.”

But Richard Stallman, founder of the GNU Project and the Free Software Foundation, disagrees. He believes that whilst Shellshock is evidently a big deal, like any vulnerability it will simply be a “blip” in the long-term.

Free software (don’t call it open source, there’s a difference, according to Stallman’s GNU crew) is still going to keep people safer than proprietary code, which comes with purposeful vulnerabilities, known as backdoors, he added.

“In the long term, this will be a blip, it’s patched, people will install. It will be one of thousands bugs that people will exploit,” Stallman told the Guardian. “When users control the program, they can add features and fix bugs.

“Any program can have a bug. But a proprietary program is likely to have intentional bugs, malicious functionality.”

He said the GNU Project always had just “barely enough” resources, but only because the more backing it received, the more it tried to do.

• What is the Shellshock bug? Is it worse than Heartbleed?

