Redis Hot Patch(benmmurphy.github.io)
benmmurphy.github.io
Redis Hot Patch
http://benmmurphy.github.io/blog/2015/06/09/redis-hot-patch/
9 comments
Back in the days when Playstation2 did not had updates, the awesome team of Insomniac did self-explotation of their own game "Ratchet and Clank: Up Your Arsenal" to get it updated: http://www.insomniacgames.com/self-exploitation/
well, it only works on OSX
(error) ERR Error running script (call to f_57391bcdbf300562e6ad7201a1578740bccffb11): @user_script:4: user_script:4: Not OSX => LinuxI have a version for Linux but apparently there are a lot of open unpatched Redis servers on the internet and it doesn't take much to change the patcher to do something else.
Could it be changed to scan for other systems and propagate automatically, thus becoming a self-healing worm like Welchia was?
Yes. But the version I have posted is not particularly useful. It only targets OSX and there are probably not many OSX machines running Redis that are directly accessible on the internet. A lot of the code in the patcher is dedicated to parsing the Macho binary so there is a bit of effort in parsing ELF instead if you wanted to port it to Linux. Also, on Linux there are some protections (https://sourceware.org/glibc/wiki/PointerEncryption) around the longjump buffer that you need to break as well if you want a patcher that won't also kill the Redis instance.
You're not helping by keeping a fix out of people's hands.
There is a documented, reliable fix in everyone's hands, namely to shut down Redis and upgrade it. This is a cute hack with a chance of crashing everything.
One thing I learned from working at Ksplice was that the amount of effort needed to build reliable live patches was huge, way more than the amount of effort needed to build a live patch good enough for your average script kiddie, who often doesn't care about crashing one percent of machines, and definitely doesn't care about it just not working on 90% of machines. There is, unfortunately, an engineering imbalance between the difficulty of the good guys' and bad guys' goals. (This is why there was no truth to the claim that Ksplice was helping the bad guys build rootkits: the technical ability to build rootkits was there all along, since Ksplice was out of tree -- the innovative engineering in Ksplice was just making hot-patches reliable.)
One thing I learned from working at Ksplice was that the amount of effort needed to build reliable live patches was huge, way more than the amount of effort needed to build a live patch good enough for your average script kiddie, who often doesn't care about crashing one percent of machines, and definitely doesn't care about it just not working on 90% of machines. There is, unfortunately, an engineering imbalance between the difficulty of the good guys' and bad guys' goals. (This is why there was no truth to the claim that Ksplice was helping the bad guys build rootkits: the technical ability to build rootkits was there all along, since Ksplice was out of tree -- the innovative engineering in Ksplice was just making hot-patches reliable.)
I went with this fix on my linux servers: Upgrade redis.