A program that comes pre-installed on Apple’s Mac and MacBook as well as millions of other computers has a flaw that could let hackers take control of the computer, cybersecurity experts said Thursday.
Hackers would gain access to everything on the computer, such as "sensitive information, confidential information, intellectual property, customer data, financial data – the list goes on – including the ability to make changes,” Kyle Kennedy, chief technology officer at data security firm STEALTHbits Technologies, said in a statement.
The Department of Homeland Security's computer security team also issued an alert about the bug, which cybersecurity experts said had the highest threat-level rating and required only minimal wits to exploit.
The affected program, Bash, is rarely used by anyone other computer programmers. It allows users to write coded text commands that translate to actions on the computer, from simple things like deleting files to complex tasks like changing network set-ups. But many other pieces of software use Bash in the background, often without the computer user realizing.
Bash is known as a “shell program,” spawning the name “Shellshock” for the bug.
News that makes sense
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
Operating systems based off Linux, including CentOS, Debian, Redhat and Ubuntu, have issued updates to begin squashing the bug, the Department of Homeland Security said. Apple, which develops the OSX operating system, didn’t immediately respond to a request to comment.
Cable boxes, routers and other Internet-connected devices also run Bash, said Chris Stoneff, director of professional services at Lieberman Software. The breadth of devices vulnerable makes the bug a juicy target for hackers, he and others said.
The security firm Bitdefender said it had already seen attacks against Internet servers on Thursday, noting that the threat usually involves an automated program that tries to sneak in a malicious command to the server.
Some experts recommended encrypting sensitive files as a precaution.
© 2014 the Los Angeles Times. Distributed by MCT Information Services
