WEBVTT
Kind: captions
Language: en-GB

1
00:00:00.099 --> 00:00:04.310
There's a new security bug in the news. It
is called Shellshock, everyone is having a

2
00:00:04.310 --> 00:00:09.720
bit of a panic about it, and no tech journalist
seems to be trying to actually explain it

3
00:00:09.720 --> 00:00:17.700
to the public. Which isn't surprising, because
it's not the easiest thing to explain.

4
00:00:17.700 --> 00:00:20.730
Here goes.

5
00:00:20.730 --> 00:00:23.630
In the beginning, was the command line.

6
00:00:23.630 --> 00:00:29.039
The command line is a way to give a computer
instructions using text instead of clicking

7
00:00:29.039 --> 00:00:34.760
or tapping. It's like having a text message
conversation with your computer.

8
00:00:34.760 --> 00:00:39.679
So I can issue a command to say, move this
file here, or list what's running on this

9
00:00:39.679 --> 00:00:46.010
system, or change my password, and it'll do
it. Of course, it's incredibly literal-minded,

10
00:00:46.010 --> 00:00:51.030
and while there are some safeguards built
in, it is worth remembering that the command

11
00:00:51.030 --> 00:00:57.909
for "delete absolutely everything, everywhere
on this computer, yes, I'm absolutely sure"

12
00:00:57.909 --> 00:00:59.799
is only eight characters long.

13
00:00:59.799 --> 00:01:04.750
It isn't just a call-and-response thing. You
can write programs with this. You can use

14
00:01:04.750 --> 00:01:10.770
variables. So you can say 'hey, remember:
in future, when I type X, I actually mean

15
00:01:10.770 --> 00:01:14.780
this really long and complicated thing that
I've put in quotes because I don't want to

16
00:01:14.780 --> 00:01:20.030
have to retype it a hundred times. okay?'
and it'll say 'ok', and later on you can just

17
00:01:20.030 --> 00:01:21.990
type X.

18
00:01:21.990 --> 00:01:27.219
That is where the bug is! Everything inside
those quotes you see on screen should be treated

19
00:01:27.219 --> 00:01:32.939
as simple text, and never, ever, ever as a
command. That way you can pass it things from

20
00:01:32.939 --> 00:01:37.219
the outside world without worrying they might
do damage. It'll just be treated as text.

21
00:01:37.219 --> 00:01:42.670
But in one of the most popular command line
interfaces out there, Bash, if you type a

22
00:01:42.670 --> 00:01:47.469
certain string of characters into the start
of a variable, it trips up and it starts treating

23
00:01:47.469 --> 00:01:49.409
it as a command line instruction instead.

24
00:01:49.409 --> 00:01:53.890
Okay, that's a bug, but if you have to get
someone to type a physical command in, that

25
00:01:53.890 --> 00:01:56.049
is not exactly the best exploit in the world.

26
00:01:56.049 --> 00:01:59.890
The trouble is: you don't have to get someone
to type.

27
00:01:59.890 --> 00:02:04.729
Because the command line is also a way for
different programs to talk to each other.

28
00:02:04.729 --> 00:02:10.570
Unix, the operating system that is the inspiration
for what a lot of these modern servers run,

29
00:02:10.570 --> 00:02:15.630
is based on the idea that rather than trying
to rewrite code all the time, programs should

30
00:02:15.630 --> 00:02:20.630
just call other, simpler programs. If you
need to search through a file for certain

31
00:02:20.630 --> 00:02:25.040
words, you don't write the code to do that
yourself, it's been done for you, better,

32
00:02:25.040 --> 00:02:30.390
probably: your own program uses the command
line, quietly in the background, and look

33
00:02:30.390 --> 00:02:35.560
at the output it gets sent back, quietly in
the background. Never appears on screen, never

34
00:02:35.560 --> 00:02:40.160
with text, but it's handled by the same shell,
usually Bash.

35
00:02:40.160 --> 00:02:45.400
Can you see where we're going? Because the
program that serves you a web page will use

36
00:02:45.400 --> 00:02:50.450
that Bash command line sometimes, to talk
to other, smaller programs. Badly-written

37
00:02:50.450 --> 00:02:55.290
web apps, probably things written in PHP,
my favourite language of all, will use the

38
00:02:55.290 --> 00:03:00.390
command line sometimes, it's really bad form,
but they will. Embedded systems, things like

39
00:03:00.390 --> 00:03:06.410
routers, maybe even small smart-home devices...
they might just use the Bash command line,

40
00:03:06.410 --> 00:03:12.170
because they trust it to be safe. But if the
input from the world, the things from random

41
00:03:12.170 --> 00:03:17.080
web users that they're sending to you, if
they've been been maliciously crafted to include

42
00:03:17.080 --> 00:03:23.040
that special string of characters... oh dear.
Any person out there on the web might suddenly

43
00:03:23.040 --> 00:03:27.770
be able to run very dangerous commands on
your web server. You have what is known as

44
00:03:27.770 --> 00:03:34.250
Remote Code Execution. Or being owned. Probably
with a zero, because it's the internet. You

45
00:03:34.250 --> 00:03:38.490
can almost certainly crash servers with that,
you can probably do much worse damage. By

46
00:03:38.490 --> 00:03:42.760
the time this video goes out, I'll be very
surprised if someone hasn't crafted a clever,

47
00:03:42.760 --> 00:03:46.950
self-replicating attack that's happily going
round the world copying itself.

48
00:03:46.950 --> 00:03:53.640
And the really bad news: that bug has been
sitting, unnoticed, in Bash for about 25 years.

49
00:03:53.640 --> 00:03:57.750
There is a hell of a lot of patching to do.

50
00:03:57.750 --> 00:04:02.450
So that's how it works. The lesson for the
end user? Make sure you keep your computer

51
00:04:02.450 --> 00:04:06.940
and any servers you run up to date with patches
and security fixes. There's not much you can

52
00:04:06.940 --> 00:04:11.280
do about bugs like this, but you can try to
keep up to date. As for those of you writing

53
00:04:11.280 --> 00:04:15.230
code that's run 'near the metal', as they
say, code that could actually be affected

54
00:04:15.230 --> 00:04:20.250
by stuff like this, well, all I can say is:
I really hope you're not taking your security

55
00:04:20.250 --> 00:04:21.599
tips from some guy on YouTube.

56
00:04:22.500 --> 00:04:24.500
[Translating these subtitles? Add your name here!]