Malicious software libraries found in PyPI posing as well known libraries
1–10 of 254 posts
Re: Malicious software libraries found in PyPI posing as well known libraries
#2Dry run?
Re: Malicious software libraries found in PyPI posing as well known libraries
#3The regex they have for identifying fake/harmful packages is wrong.
`pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '`
This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages.
[UPDATE]
Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.
Re: Malicious software libraries found in PyPI posing as well known libraries
#4Dry run?
The "malicious" code at the end of the advisory looks like nothing more than a beacon announcing it was installed?
edit:
get current working directory
get username
get hostname
concatenate the last 3 together
obfuscate(/encrypt?) this string
send the result as a http request to 121.42.217.44 (the value of the base64 string)Re: Malicious software libraries found in PyPI posing as well known libraries
#5Related to this? http://incolumitas.com/2016/06/08/typosquatting-package-mana...
Re: Malicious software libraries found in PyPI posing as well known libraries
#6This is interesting in conjunction with the recent post about Python's popularity because that may be a weakness exploited here [1.]. It's easy to use and install and get libraries for anything, and apparently libraries for infecting your machine :(.
Re: Malicious software libraries found in PyPI posing as well known libraries
#7It looks like the code phones home to a server in China:
IP: 121.42.217.44 Decimal: 2032851244 Hostname: 121.42.217.44 ASN: 37963 ISP: Hangzhou Alibaba Advertising Co.,Ltd. Organization: Hangzhou Alibaba Advertising Co.,Ltd. Services: None detected Type: Broadband Assignment: Static IP Blacklist: Click to Check Blacklist Status Continent: Asia Country: China cn flag State/Region: Zhejiang City: Hangzhou Latitude: 30.2936 (30° 17′ 36.96″ N) Longitude: 120.1614 (120° 9′ 41.04″ E)
Re: Malicious software libraries found in PyPI posing as well known libraries
#8The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.
I believe urllib3 is built-in. So if you have installed it from PyPI you've gotten a malicious version.
Re: Malicious software libraries found in PyPI posing as well known libraries
#9The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.
[deleted]
Re: Malicious software libraries found in PyPI posing as well known libraries
#10The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.
Not for me. There is space at the end between the closing bracket and the apostrophe. Maybe you did remove this space when you corrected the smart apostrophes.