Shellshocked?
Posted by Andrew Hodgkinson Sat, 27 Sep 2014 06:39:00 GMT
Within the last couple of days, you might have heard about a really nasty security problem that’s so important it has already been given a name and an unofficial logo (!):
The server running the ROOL web site was vulnerable to this issue but has been patched, with another patch due for a secondary, much less serious aspect of the bug for which a fix is not yet available.
The circumstances under which the bug can be exploited are complex and need to be assessed on a case-by-case basis for every web site. I’ve had a careful look through the software we use at RISC OS Open and, as far as I can tell without a very time consuming full depth analysis, our server software does not pass through requests from the web in such a way that it would have exposed the buggy, exploitable component. So, even during the day before our server got patched, it doesn’t look like we could have been compromised.
There is evidence of attempts to scan our site for the vulnerability in our server logs. These attempts were not successful.
The most valuable thing we might have stored in our database would be your passwords. Attackers love to get hold of them, then try re-using them on other sites. We do not store your password and never have. We store an encrypted token, using a one-way encryption algorithm. We cannot take the token and run that encryption “backwards” to produce your password, even if we wanted to. All we can do is take the passwords presented to us in log-in forms (which we neither store nor log anywhere), apply the encryption to produce a token, then see if the token matches what we have in our database. As a result, even if our database was compromised and we didn’t know it, password information would not be recoverable in a computationally feasible timescale. It’s easier for attackers to just guess with random and/or common passwords, as with the recent iCloud celebrity photograph breach.
We’re not exactly the most high profile or valuable site on the web :-) but we do get well over a million hits and average around 75GB of traffic per month, so we’re certainly not the quietest. We try to always remain vigilant when it comes to security.
(All patches now applied).