At the turn of September and October 2014 the world learned of a security vulnerability that had been lurking for years in the GNU Bourne Again Shell (a.k.a. Bash). Most IT-security outlets had already covered the topic and published appropriate remediation methods, yet what caught my attention was the educational aspect of the flaw – in that regard it is a “good bug”, that is, one that can be used to explain many interesting mechanisms present in Unix-like systems.

When typing a website name into the browser’s address bar, mistakes sometimes happen. Instead of visiting the right site, we end up on a so-called domain parking page, or in a completely different service. There are also less safe situations—sites deceptively similar to the originals, used to siphon data or infect a computer with malware. Let’s imagine that a similar situation could occur even when the entered address was correct…

Attacks that rely on setting up fake update servers are not as difficult to carry out as one might think. The main reasons are administrators’ carelessness and the absence of robust version-publishing processes, although occasionally we see astonishing attack vectors that are hard to anticipate.