Skip to main content

Q&A: Experts warn of Bash Bug, what are the risks?

By WTOP Staff

MICHAEL LIEDTKE
AP Technology Writers

NEW YORK (AP) — Internet security experts are warning that a new programming flaw known as the “Bash Bug” may pose a serious threat to computers and other devices such as home Internet routers. Even the systems used to run factory floors and power plants could be affected.

So, is it time to panic? Here are some common questions and answers about the latest security scare.

___

Q. What is the Bash Bug, and why is it a big deal?

A. The bug, also known as “Shellshock,” is in a commonly used piece of system software called Bash. Bash has been around since 1989 and is used on a variety of Unix-based systems, including Linux and Mac OS X.

Devices that use Unix in some form include many servers, routers, Android phones, Mac computers, medical devices and even the computers that create bitcoins. Systems running power plants and municipal water systems could also be affected by the bug, though security experts already recommend that these systems remain disconnected from the Internet so they are not open to such risks.

Bash is a command shell — “the thing you use to tell your computer what you want it to do,” explains Christopher Budd, global threat communications manager at security firm Trend Micro. Thus, exploiting a security hole in Bash means telling your computer, or other systems, what to do.

___

Q. Why are people saying it’s worse than “Heartbleed,” the flaw that exploited security technology used by hundreds of thousands of websites?

A. While Heartbleed exposed passwords and other sensitive data to hackers, Bash Bug lets outsiders take control of the affected device to install programs or run commands. Bash Bug is rated 10 on a 10-point scale for its impact and ease of exploitability by the Common Vulnerability Scoring System, an industry standard for assessing how bad security flaws are. Heartbleed is rated 5.

On the other hand, a perfect set of conditions need to be present for the bug to be open to exploitation, which could limit its effect.

Heartbleed affected any system running OpenSSL, a common Web encryption technology. With the Bash Bug, your system actually has to be using Bash, Budd said. There are multiple types of command shells, so even if Bash is installed, the system could actually be using a different one.

___

Q. It’s been a quarter century since Bash came out, so why is the bug a threat now?

A. That’s because someone — Stephane Chazelas of Akamai Technologies Inc. to be specific — just found it.

“That’s the thing with security bugs,” Budd said. “It takes a person actually looking at that code, and seeing it, and saying ‘that’s not right'” to find problems.

Heartbleed was around for more than two years before it was discovered.

___

Q. What can you do about it?

Everyday users can’t do much right now, except to wait for manufacturers to release fixes for the particular product. Companies are already releasing patches that correct the flaw, so Budd recommends applying the patches for routers, Macs and other devices as they come out.

But that can be easier said than done. Budd said it will depend on who made the equipment and whether you get a fix at all. Even if a fix is developed, getting it could be another matter. Budd expects that to be an issue with Android phones, because their manufacturers and carriers are often slow to push out the system updates that Google provides.

Of course, it always helps to run up-to-date security software on your devices.

___

Michael Liedtke reported from San Francisco.

Copyright 2014 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Don’t Settle for Student Loans to Pay for Online Education

By WTOP Staff
Online college programs are becoming a more popular choice for prospective students, with one study finding that more than 6 million students enrolled in at least one online course in fall 2015. The popularity of these courses can be attributed in part to their flexibility with working adults' schedules, students' ability to progress more quickly through online programs and, oftentimes, cheaper tuition. [See 10 low-cost online bachelor's programs for out-of-state students.]Online degrees can be beneficial to many college students, but some studies have shown online learners complete their programs at lower rates than students at traditional brick-and-mortar campuses. Individuals with student loans but no degree comprise two-thirds of defaulted borrowers. Though these numbers are not encouraging, just like for traditional programs, there are ways to reduce how much you'll need to borrow for an online program to ensure you won't become one of these statistics. Don't just settle on borrowing student loans to cover the whole cost of your program and living expenses. Instead, start thinking about how to cut costs and cover your balance in different ways, such as the following. -- Grants and scholarships: Even though you are taking an online course, you can still apply and receive grants and scholarships. But your first step should be to complete the Free Application for Federal Student Aid, commonly referred to as the FAFSA, which will allow you to receive a Pell Grant if your expected family contribution is low enough. The EFC criteria and award amounts are adjusted annually, but the 2017-2018 academic year awards range from $606 to $5,920, which could significantly lower the amount you borrow annually. Your next step is to apply for scholarships. You can start by checking online scholarship search engines, such as the Salt Scholarship Search, College Board's BigFuture and Peterson's. But don't forget to take advantage of local organizations and your school's financial aid office. Both may offer scholarships that you can't find with a national scholarship search. [Review these 10 sites to kick off your scholarship search.]For instance, organizations like the Elks Club, Knights of Columbus or the Rotary Club typically offer scholarships annually to local students. Just because you're going to school online doesn't mean you're ineligible. Visit your local library for scholarship listings, and ask around town. You might be surprised how many local organizations offer scholarships. While these scholarships typically aren't large, every little bit counts. Each dollar you receive in a scholarship is a dollar you don't have to borrow and pay interest on. -- Work-study: Another option for online students may be work-study awards. Not all students enrolled in online programs are eligible, but students at some schools -- including, for example, SUNY Empire State College and Liberty University -- are. Work-study awards are not given upfront like scholarships and grants. In most cases, they are an offer to earn up to the awarded amount if you secure an eligible work-study job. While there is a misconception that all work-study jobs must be on campus, students can work for off-campus, nonprofit or public employers as long as the work is in the public's interest. You may be able to work for a for-profit employer if the job is relevant to your course of study. No matter who the outside employer is, it will need to have an established agreement with your college for you to receive work-study funds. Remember, to be eligible for federal financial aid, you must be enrolled and pursuing a degree or certificate. If you're not working toward a credential, Pell Grants and work-study won't be option, but you may still be able to take advantage of private scholarships -- just be sure to read the eligibility criteria carefully. [Explore what to know about financial aid in online programs.]-- Pay as you go: One of the great benefits to enrolling online is the flexible schedule, which can allow you to complete your college coursework around your responsibilities. But prospective students often overlook using their part- or full-time job earnings as an option for paying for college. Almost 80 percent of college students in 2015 worked at least part time while attending classes, according to the National Center for Education Statistics. By budgeting and thinking strategically about your college costs, you can likely reduce your dependence on student loans by paying a portion out of pocket. Many -- but not all -- online programs are less expensive than traditional programs and often have shorter payment periods. Six, eight or 10 weeks are common course durations. Because of the frequency of payments in an online setting, you may be well-placed to pay as you go and possibly avoid borrowing altogether. Attending college online and avoiding student loans may be challenging, but if you are willing to put in the effort, you can limit the amount you need to borrow. More from U.S. News Q&A: Understanding Student Loan Discharge Eligibility Student Loan Refinancing Isn't Right for All Borrowers
Read Next Story

Related News

Frustration grows in Venezuela as earthquake death toll reaches 1,430

Israel and Lebanon sign framework agreement with US in ‘first step’ toward peace, Rubio says

Trump-endorsed populist poised to become Colombia’s next president as rival challenges vote