Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious software libraries found in PyPI posing as well known libraries

nbu.gov.sk

Post reply on HN
Print view View original

61–70 of 254 posts

Re: Malicious software libraries found in PyPI posing as well known libraries

#61

Post by disconnected »

kasabali wrote: post #53

Yet another attack vector that doesn't exist at all in Linux distributions but invented by language package managers, sadly. They solved the issue 2 decades ago by heavily vetting packages before accepting them into repositories. Users are allowed to add and use packages from 3rd party repositories. Maybe solution to this is creating curated repositories based on publicly open ones and using them by default (and requ…

> Yet another attack vector that doesn't exist at all in Linux distributions but invented by language package managers, sadly.

https://www.schneier.com/blog/archives/2008/05/random_number...

A.K.A., the Debian openssl Fiasco.

Just one example of distros fucking up the packages from upstream and causing major havoc.

Re: Malicious software libraries found in PyPI posing as well known libraries

#62

Post by mbrock »

raesene6 wrote: post #57
mbrock wrote: post #49

Earlier quoted context omitted.

I think it might just not have happened yet. The npm community can be pretty creative and enthusiastic! I don't think IRL identities are necessary for what I imagine. It's more like establishing a basic set of packages that have been around, have communities of committers, reverse dependencies, etc. Maybe we would even make a starting assumption that the transitive closure of dependencies originating with a set of hi…

So, apologies for being a bit cynical here, but I don't see this one being addressed any time soon. it's been at least 5 years since npm started getting scrutiny relating to security weaknesses https://blog.andyet.com/2012/03/08/compromising-the-integrit... and 4 years since Rubygems was compromised http://blog.rubygems.org/2013/01/31/data-verification.html and yet, I don't see substantial movements relating to packa…

I'm skeptical too. But if I think like a sci-fi writer I can vaguely imagine ways for it to actually happen. That open source maintenance happens at all is pretty remarkable, so I think this thing, with an appropriate concept and some good tools (with emojis in their command line output), is at least vaguely plausible...

Re: Malicious software libraries found in PyPI posing as well known libraries

#63

Post by a_participant »

sdiepend wrote: post #47
thearn4 wrote: post #7

It looks like the code phones home to a server in China: IP: 121.42.217.44 Decimal: 2032851244 Hostname: 121.42.217.44 ASN: 37963 ISP: Hangzhou Alibaba Advertising Co.,Ltd. Organization: Hangzhou Alibaba Advertising Co.,Ltd. Services: None detected Type: Broadband Assignment: Static IP Blacklist: Click to Check Blacklist Status Continent: Asia Country: China cn flag State/Region: Zhejiang City: Hangzhou Latitude: 30.…

When you go this adress http://121.42.217.44:8080/ "Hi bro :) Welcome Here! Leave Messages via HTTP Log Please :)"

Perhaps they have a zero day telnet client or browser exploit. :)

Re: Malicious software libraries found in PyPI posing as well known libraries

#64

Post by cdnsteve »

raesene6 wrote: post #45
cdnsteve wrote: post #42

Earlier quoted context omitted.

If there was a business/enterprise offering with extra security I'm sure they'd have a long list of people who would sign up and happily pay for it.

Those service already exit, e.g. https://www.sourceclear.com/ whilst I hope they're doing well, I don't think they've made significant in-roads into the volume of people using open source software library repo's.

It needs to be part of PyPi directly, I would have a difficult time trusting and unknown third-party.

Re: Malicious software libraries found in PyPI posing as well known libraries

#65

Post by zzzcpan »

Sir_Cmpwn wrote: post #29

I think a more Linux-like approach to package repos is better - a curated package repository run by volunteers in maintainership roles. Then you have a human being verifying the upstream and keeping malware out, and get more consistency across packages as a bonus. If you want your package added it's as simple as sending an email and provides a new avenue for people to contribute to the success of the ecosystem as pac…

I don't think there are any maintainers that verify upstream code, they only manage packages and updates. Which is actually safer to do without maintainers, completely automatically, as it will eliminate a huge attack surface introduced by a maintainer.

Re: Malicious software libraries found in PyPI posing as well known libraries

#66

Post by cdnsteve »

raesene6 wrote: post #48
cdnsteve wrote: post #43

Earlier quoted context omitted.

I'm sure companies would pay for it. The service needs to be part of the main package service, not some third party.

Interesting if you think that npm/Rubygems/PyPI are leaving a load of money on the table, why do you think they haven't introduced those services so far...

Because their mission isn't to generate income like a traditional business. But if the income went back to the foundations, like Python Foundation, I think that would make sense.

Re: Malicious software libraries found in PyPI posing as well known libraries

#68

Post by underko »

cdnsteve wrote: post #52

I'm all for security but this hit a nerve with me: "Success of the attack relies on negligence of the developer, or system administrator, who does not check the name of the package thoroughly." Package managers need to do more. If they had an enterprise version that you could subscribe to monthly/annually invoice that you would get enterprises onboard, they are concerned about security and will pay. Developers like u…

There's written to check the package name and not to go through whole source code.

Re: Malicious software libraries found in PyPI posing as well known libraries

#69

Post by zapt02 »

kumarvvr wrote: post #56

Whoa urlib & urllib3. Those are pretty popular packages, especially to newbies. Hundreds of websites that teach web-scraping use those libraries. Wonder what is an effective form of protection against such attack vectors? Do digitally signed certificates fit into this usage scenario??

> Do digitally signed certificates fit into this usage scenario??

No, because either the package author would have to sign them, in which case you have to choose to trust each package author, or the repository would sign them, in which case there would be no improvement for this current issue, since the repo would sign the fake packages as well.

Re: Malicious software libraries found in PyPI posing as well known libraries

#70

Post by raesene6 »

cdnsteve wrote: post #66
raesene6 wrote: post #48

Earlier quoted context omitted.

Interesting if you think that npm/Rubygems/PyPI are leaving a load of money on the table, why do you think they haven't introduced those services so far...

Because their mission isn't to generate income like a traditional business. But if the income went back to the foundations, like Python Foundation, I think that would make sense.

npm is a commercial organisation, they offer paid subscriptions but don't offer a curated package signed option...
Post reply on HN