Two malicious Python libraries caught stealing SSH and GPG keys
1–10 of 323 posts
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#2Alarming given that pypi is treated as trusted by many I think (even if it shouldn't)
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#3bruh moment:
$ python -m pip list | grep date
python-dateutil 2.8.0
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#4> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library.
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#5To search your own projects for the malicious libraries:
pip3 freeze | grep -i jeIlyfish
pip3 freeze | grep -i python3-dateutil
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#6> The first is "python3-dateutil," which imitated the popular "dateutil" library. The second is "jeIlyfish" (the first L is an I), which mimicked the "jellyfish" library.
Wish they listed out how many installs.
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#7There are probably several open-source projects that you can download today that include unknown malicious code. But they will be discovered eventually. Proprietary software, on the other hand, can keep malicious code during their entire life of relevancy. And in fact, it's rare for proprietary software to not have malicious code these days, with personal data being sent to servers, ads being delivered, and installers bundling third party products and plugins.
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#8I get the python3-dateutil because you might think it's an updated version of the standard library.
But how does jellyfish with a different char for L work? Someone would need to copy and paste it. But if they go to pypi, it won't have many installs.
Unless they started writing tutorials with:
"okay now just pip install X"
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#9What's the best information source for me to follow to keep up to date on these kinds of library vulnerabilities?
I would make a feed of the homepages for all the libraries I know I use, but that won't help me with the libraries I use without knowing.
Re: Two malicious Python libraries caught stealing SSH and GPG keys
#10These two have been caught. How many haven't yet been caught?
Traditional Unix file permissions are pretty much a joke for the way developer computers get used (one user - does everything). Real process sandboxing is needed.