Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Antigravity.py (2020)

github.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Antigravity.py (2020)

#41

Post by geofft »

dpwm wrote: post #34
btown wrote: post #31

Earlier quoted context omitted.

And specifically, although it is nowadays uncommon for Python scripts to be run the way old-school WSGI web services were, with a script being fired up for every request and mapping user-controlled query parameters to environment variables, this was at one time actually the motivating example for https://www.python.org/dev/peps/pep-0333/ ! It's a common enough attack pattern that https://capec.mitre.org/data/definiti…

Surely this is only a security risk if antigravity is imported? What cause would there be to import antigravity in a CGI service – or anything other than a terminal in which you could already execute arbitrary code? I am struggling to understand, even with the proof of concept, how the situation could arise where an attacker could realistically exploit this, based largely on the uselessness of the antigravity module.

See the "Making Progress With PYTHONWARNINGS" section in the article posted - setting the environment variable PYTHONWARNINGS to a value mentioning the antigravity module causes it to be imported, even if there's no "import antigravity" statement in the actual source.

Re: Antigravity.py (2020)

#42

Post by dpwm »

geofft wrote: post #41
dpwm wrote: post #34

Earlier quoted context omitted.

Surely this is only a security risk if antigravity is imported? What cause would there be to import antigravity in a CGI service – or anything other than a terminal in which you could already execute arbitrary code? I am struggling to understand, even with the proof of concept, how the situation could arise where an attacker could realistically exploit this, based largely on the uselessness of the antigravity module.

See the "Making Progress With PYTHONWARNINGS" section in the article posted - setting the environment variable PYTHONWARNINGS to a value mentioning the antigravity module causes it to be imported, even if there's no "import antigravity" statement in the actual source.

Not sure how I missed that – it was even in the proof of concept in the message I replied to. Thanks for the help.

There are multiple failings that don’t seem like a big deal taken in isolation:

- The PYTHONWARNINGS and whole Warning Filters system.

- The webbrowser module executing a given executable from an environment variable.

- The antigravity module running webbrowser.open() on import.

All of these sort of seem a bit like sacrificing good taste for convenience. But in combination, in a situation where you don’t control the environment variables, they do lead to arbitrary code execution.

In other words, it’s not all antigravity’s fault, but those side effects on import make this possible.

Re: Antigravity.py (2020)

#43

Post by nwsm »

chronolitus wrote: post #40

A description of what the code does: First, the line webbrowser.open(" https://xkcd.com/353/ ") is obvious, it opens a browser pointing to the relevant XKCD comic, containing a joke which inspired this code. Then, a geohash function is declared which takes the user's current latitude/longitude, and the current date-time, and returns a target latitude/longitude. According to a previous comic ( https://xkcd.com/426/ )…

For more context, "geohashing" is a play on geocaching [0].

This is not to be confused with a geohash [1].

[0] https://en.wikipedia.org/wiki/Geocaching

[1] https://en.wikipedia.org/wiki/Geohash

Re: Antigravity.py (2020)

#44

Post by dpwm »

jvanderbot wrote: post #39
dpwm wrote: post #34

Earlier quoted context omitted.

Surely this is only a security risk if antigravity is imported? What cause would there be to import antigravity in a CGI service – or anything other than a terminal in which you could already execute arbitrary code? I am struggling to understand, even with the proof of concept, how the situation could arise where an attacker could realistically exploit this, based largely on the uselessness of the antigravity module.

I left one window open, but what is to guarantee a burgler would use that window??

Absolutely, I agree now that I see it, and these seem like numerous innocent-seeming footguns just waiting for abuse.

Add the not-too-far-fetched-seeming assumption that it’s fine to let the Internet define your environment variables, and it’s a plausible exploit.

This is why, as another commenter points out, defense in depth is so important.

Re: Antigravity.py (2020)

#45

Post by boublepop »

tersers wrote: post #3

TIL python has a webbrowser module

Back in the day, python was popular because it was a “batteries included” language, which meant I supposedly had almost everything you would need right there in the standard language. These days of cause no one runs python without going on a shopping spree of additional packages on pypi, so it would be less of a big deal if it didn’t include a browser lib, or a GUI lib out of the box.

Re: Antigravity.py (2020)

#46

Post by kzrdude »

dpwm wrote: post #42
geofft wrote: post #41

Earlier quoted context omitted.

See the "Making Progress With PYTHONWARNINGS" section in the article posted - setting the environment variable PYTHONWARNINGS to a value mentioning the antigravity module causes it to be imported, even if there's no "import antigravity" statement in the actual source.

Not sure how I missed that – it was even in the proof of concept in the message I replied to. Thanks for the help. There are multiple failings that don’t seem like a big deal taken in isolation: - The PYTHONWARNINGS and whole Warning Filters system. - The webbrowser module executing a given executable from an environment variable. - The antigravity module running webbrowser.open() on import. All of these sort of seem…

You're right about sacrificing good taste for convenience, but since this is an easter egg, it's sacrificing good taste for a laugh, and I think that pushes it over the precipe over into being a bad idea.

Re: Antigravity.py (2020)

#47

Post by xavdid »

I've long known that `import antigravity` would open the xkcd comic, but I never knew there was also a geohashing function!

That was a favorite activity of mine in high school. On Friday evening, we'd look at the nearest graticule(s) to our town and pick one for a Saturday day trip. Trucking out to a random point on a map is a great way to explore your metro area and see things you never would otherwise.

Heartily recommend trying it out. Looks like the map (linked from the comic) is no longer working: http://carabiner.peeron.com/xkcd/map/map.html

But, with this function, there may yet be hope!

Re: Antigravity.py (2020)

#48

Post by raymondh »

xavdid wrote: post #47

I've long known that `import antigravity` would open the xkcd comic, but I never knew there was also a geohashing function! That was a favorite activity of mine in high school. On Friday evening, we'd look at the nearest graticule(s) to our town and pick one for a Saturday day trip. Trucking out to a random point on a map is a great way to explore your metro area and see things you never would otherwise. Heartily rec…

I added the geohash() function and am delighted that it eventually got found.
Post reply on HN