Shellshock Exploit – Manually patching BASH

Recently the events concerning the Shellshock exploit have been all over the media. This one is bad.. real bad:

Remote exploit vulnerability in bash CVE-2014-6271

However it’s entirely possible that your Linux distribution might not have a patch readily available if say, you’re running an older linux distro like Ubuntu 8.0.4

Fear not.. building and installing your own patched version of bash is fairly straightforward, presuming you have GCC and build tools installed with your distribution. If you’re comfortable building code you can do the following:


#assume that your sources are in /src
cd /src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 0 25);do patch -p0 < ../bash43-$i; done
#build and install after retrieving and patching the bash build files
sudo ./configure --prefix=/usr --bindir=/bin --sbindir=/sbin --sysconfdir=/etc && sudo make && sudo make

Here’s a link to the original discussion on this over on Hacker News

Manually Update your T-Mobile G1 to OS 1.5 (Cupcake)

T-Mobile was supposed to release Android OS 1.5 (originally code-named ‘Cupcake’) was supposed to be released the week of May 18th. However T-Mobile decided to delay the release.

Enter the Android community… Someone has found the downloadable version of Cupcake, signed and ready to install on the T-Mobile G1! And with a few simple steps, you can install it before the T-Mobile OTA (over-the-air) push.

Now, without any further ado – the following warning:

WARNING: T-Mobile does not support manual installations and will not assume responsibility for any device problems or failures that occur from following these instructions.

*NOTICE: This can be a risky procedure, and if you make a mistake and brick your phone: T-Mobile, the T-Mobile Forums, authors of this post (i.e. ME), or other subsequent discussions, nor any party, company, corporate entity, individual, or estate; living or dead, associated or otherwise connected with the above shall not be held liable for any damage you do to your device, others devices, your person, other people/living things, or property belonging to you any other entity in the known universe should you attempt to root your phone. You take full responsibility and liability for any action you choose to take to attempt to gain root access to your phone. Do this at your own risk.

  1. Go download the Android 1.5 ‘Cupcake’ release here.
  2. Rename the downloaded file from signed-kila-ota-148830.de6a94ca.zip to update.zip and place it at the root i.e the very top directory of your Micro SD card. (If you added the file to your microSD card by connecting the handset to your computer via USB [rather than using a dedicated microSD card reader], make sure to unmount it and disconnect the USB cable now.
  3. Turn off your G1 Make sure it is completely powered off. Now again turn it on by holding the Home+End keys until you see T-Mobile G1 logo.
  4. From the icon screen, open the keyboard and hit Alt+L.
  5. Press Alt+S to begin the update. Remember, the update needs to be in the root of the Micro SD card and needs to be named update.zip.
  6. Once it finishes, follow the onscreen instructions and press Home+Back to finish.
  7. G1 Phone will reboot a few times to flash different parts of the firmware.

If all went well, you should now be running Android Release 1.5 on your T-Mobile G1…!

And, yes.. I installed it using the above steps.. and it’s working great..!

Dive into Android OS Development!

With the shipment of the T-Mobile G1 there’s now an ever-expanding base of users on the new Google Android Platform. If you are an application developer this is an excellent platform to develop on with a bright future ahead of it.

Here’s some development resources to help get you started:

  • The Android HomePage
    This is where it all begins. You can get the SDK here, find out what Android can do, and even take your first steps writing the classic Hello, World application.
    http://code.google.com/android/

  • anddev.org – Android Development Community and Tutorials
    Arguably the best Android development resource to date. With tutorial videos and lots of sample applications and projects to work from. As well as a friendly and supportive community.
    http://www.anddev.org/index.php

  • Android Discussion Groups from Google
    These are Google’s own discussion groups. Topics support beginner-level questions, experienced android developers, OS Internals, security, etc.
    http://code.google.com/android/groups.html

If you’re looking for general Android discussions outside of development-related chat check out the Android Community at http://androidcommunity.com/

Mac OS X Leopard vs Vista

Chris Pirillo’s website has a great breakdown of Leopard vs Vista where he shows overall why Leopard is a better OS than vista.

Mac OS X Leopard vs Microsoft Windows Vista

While the article IS interesting what really caught me off guard was this comment from one of his readers:

Don Mitchell – September 1, 2007 @ 11:01 am

Apple is great at design, but not especially good at operating system kernels. They gave up on their in-house OS and fell back on UNIX, an operating system that is woefully obsolete today.

This is, without doubt, one of the most idiotic statements I have ever read, bar none. All companies today use Unix in one form or another – HP/UX, Linux, Solaris – the list goes on. Unix is the operating system of business. Windows tried with their monolithic NT-based kernel and are losing ground every day.

But Mr. Mitchell continues his rampant idiocy:

The perfect PC would have an Apple UI and shell, with the Windows NT kernel and DirectX for advanced 3D graphics and games. NTÂ’s kernel is still considerably more advanced than any version of UNIX, with kernel threads, fibers, events, completion ports, asynchronous I/O, multiple heaps, and a collection of concurrency control features. Some of these features have been kludged into UNIX in recent years, but it was never designed to do these things.

The PC should also be an open hardware platform like the Windows PC is, but the Mac is not. I should be able to select from different competing hardware vendors, or pull out my nVidia graphics card and install an ATI card if I so desire.

This guy has obviously drank the Microsoft Kool-aid for FAR too long. His only concern above is “advanced 3D graphics and games”. Mr. Mitchell, go back to ITT Tech and demand your money back NOW. The education you got there was not worth the paper your worthless diploma was printed on.

Virtualization Roundup on the Mac

Got a Mac? Need to run Windows? You can always use Bootcamp… But how about Linux? That’s a bigger challenge. However with virtualization you can install either and run them along side OS/X. Currently there are 3 virtualization tools:

Low End Mac has a couple of articles that show all three. They’re worth a read:

Microsoft – if you can’t beat ’em buy ’em, or at least their name…

[Originally Posted 20-July-2004]

Microsoft has been trying to put a stop to the Lindows Linux distribution because the name, according to them, represents Trademark infringement:

http://news.zdnet.co.uk/software/0,39020381,2101619,00.htm

Well, Microsoft is losing that battle. So what did they do? They bought the Lindows name from Lindows (who now goes by the far better name Linspire) for US$20 Million:

http://news.zdnet.co.uk/software/linuxunix/0,39020390,39161016,00.htm

Sun Java Desktop System Should Scare Microsoft…

[Originally Posted 26-May-2004]

The Sun Java Desktop System should scare Microsoft… At least that’s what the San Jose Mercury News wants you to think.

However, it probably won’t. Linux.com just tried JDS Release 2 on four machines. And on all four of them it simply wouldn’t run…

From the article:

Four out of four computers agree: Sun Java Desktop System 2 doesn’t work on anything remotely resembling a modern machine.

Linux FileSystem Comparisons…

[Originally Posted 12-May-2004]

If you use Linux you’ll find this interesting. If you use Linux and don’t understand what a file system is, please re-format your computer and install Windows XP – you might be better off..

Link: Linux FileSystem Benchmarks

The summary is that ReiserFS is the overall best File system over all of what I consider the “popular” File System formats (such as ext2 and ext3).