Clever and “Shellshock”

Clever’s Response to the “Shellshock” Security Issue

Recently, a critical security issue was discovered and disclosed to the larger community. This issue, nicknamed Shellshock, could have allowed an attacker to take control of certain systems using specially crafted HTTP requests. The vulnerability came from a flaw in Bash, a tool used by the majority of Internet web servers, including some of Clever’s machines.

Even though we had no reason to believe that any of our services were directly vulnerable, we immediately took action on Wednesday, September 24th to completely secure all of our systems. Our developers worked around the clock to apply fixes as soon as they became available, typically within an hour of release.

We have investigated our systems for evidence of any attempts to exploit this vulnerability and found no such evidence. We will continue watching “Shellshock” closely, and continue to scan for malicious attempts to access Clever’s systems.

If you’d like more general information about “Shellshock”, please read more on the Clever engineering blog.