DevCentral Top 5: Oct 6, 2014

These past two weeks have proven to be more than eventful with the "shock"ing discovery of a critical bash vulnerability that stole the security headlines for several days.  Times like these might have you repeating the words of the infamous Ben Jabituya, "I don't know about you, but I am planning to scream and run."  Fortunately for all of us, there's no need to scream and run...there's only a need to sit back and read about the most awesome articles that anyone, anywhere has to offer.  Check out this edition of the DevCentral Top 5!!

CVE-2014-6271 Shellshocked

As I stated in the opening paragraph, all our collective worlds got rocked when the Shellshock vulnerability was announced.  This vulnerability allows a remote attacker to execute instructions on your computer using a feature of the bash shell.  Enter Jeff Costlow; one of the most intelligent guys you'll ever meet when it comes to security.  Literally the same day Shellshock was released, Jeff wrote this article to explain all the details of the vulnerability and also outlined ways your BIG-IP could be exploited.  In addition, he gave some great advice on how to mitigate the vulnerability using several options available from F5...iRules, LineRate, ASM (with custom signatures), and best practices (like, don't expose your management interface to the Internet).  Jeff also participated in a Shellshock guru panel where several F5 security experts talked about the vulnerability, how it works, why it's bad, and how to mitigate it using F5 technology.

Sorry, Johnny Five. Yes Disassemble!

Jason Rahm takes us back to yesteryear with a metaphor from one of our favorite movies from the 1980s.  In that movie, Johnny 5 has a big fear of being disassembled (and rightfully so, I guess).  Well, Jason keeps Johnny 5 safe from disassembly, but doesn't afford that same luxury for Tcl code.  As you all know, Tcl forms the foundation of several code environments on the BIG-IP (iRules, iCall, iApp, tmsh).  Many of us want to know what the Tcl interpreter is actually doing from an instruction standpoint, and Jason shows us that the way to analyze the bytecode is to disassemble it.  The command that will show how the interpreter works its magic is tcl::unsupported::disassemble.  In one of the most technically-hardcore articles ever written on DevCentral, Jason digs deep into two different solution sets and reminds us that it's always a good idea to fine-tune your code.  Less is more. Less objects. Less stack depth. Less instantiation. Reviewing bytecode is good for that, and it's possible with the native Tcl code.

APM Security: Protecting Internal Resources Using ACLs

Bart Sikkes wrote up a great security solution for the APM in Portal Access mode.  The APM in Portal Access mode gives instant access to internal resources for authorized users, but it might also give access to other users if you aren't careful.  Bart sets up a test environment using three internal resources:  OWA, intranet website, and source code programming website.  Two of these should be accessible through the APM but the third should not.  Bart walks through some great examples of how someone might find a work around to access the protected internal resource.  He also provides a great solution using APM ACLs that will ensure users only access the intended resources.

Introducing LineRate Lightning series (and Snippet #1 - HTTP referer blocking)

Everyone loves the iRules 20 Lines or Less series, right?  LineRate is no exception.  The only thing is that the LineRate proxy uses a Node.js scripting engine embedded into the HTTP data path, so it can't directly use iRule scripts.  So, the LineRate guys created a new series on DevCentral called "LineRate Lightning" and these articles will contain snippets of code that aim to be quick, powerful, and even a little bit flashy.  The inaugural LineRate Lightning post includes a simple snippet of code that does HTTP referrer blocking based on a whitelist of permitted referrers.  Simply add the referring domains that you'd like to permit in the

domain_whitelist

list and change

vs_http

to match the name of your virtual server.  Pretty cool and simple solution, huh?!?  Check back often and regularly to read this series that so beautifully complements the iRule 20 LoL!

Shellshock mitigation with BIG-IP iRules

Some call him the inventor of iControl, some call him the creator of the iRule editor, some call him the most interesting man in the world, I simply call him "Joe the Show."  Joe Pruitt fired up two separate iRule solutions to mitigate the Shellshock vulnerability the day after it was released by NIST.  This is just another example of the power and flexibility of F5 technology.  Who else in the world provides so many options to secure critical infrastructure in such a short amount of time?  Joe wrote and tested these Shellshock-mitigating iRules and then posted them on DevCentral for all the world to use.  He reminds us that we should set up a plan to ultimately patch the bash shell on all our systems.  While you are creating and implementing the patch plan, you can use the iRule solution to protect your servers against attacks.