Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PyPI: Python packets steal AWS keys from users

blog.sonatype.com

Post reply on HN
Print view View original

51–60 of 104 posts

Re: PyPI: Python packets steal AWS keys from users

#51

Post by fmajid »

lovelearning wrote: post #28

In Linux, is there a secure, but also convenient and user-friendly, way to prevent processes from having the same default level of access to the filesystem as the human user? I like Android's system of per-app uid/gid. But AFAIK it's not implemented by any mainstream Linux kernel or distro. There's AppArmor, but the last time I tried it, I came away with the opinion that it's not very convenient or user-friendly. Per…

man -s 7 capabilities

I’d like to see something like OpenBSD’s pledge/unveil.

These all work at the process level, though, not individual portions of code in a process.

Re: PyPI: Python packets steal AWS keys from users

#52

Post by rjh29 »

selcuka wrote: post #4

I believe this is something that automated code parsing (a la Github Copilot) could really shine. Those tools are able to explain what a block of code does, so it should be possible to catch many types of malware hidden in source code.

Isn't this impossible as per the halting problem?

It would be better to run the code in a sandbox and log all the syscalls it makes, similar to how Cuckoo's malware sandbox works.

Re: PyPI: Python packets steal AWS keys from users

#54

Post by capableweb »

fmajid wrote: post #53
jbverschoor wrote: post #38

Network access (outgoing) should be firewalled a lot more these days.. There’s almost no need to open an outgoing connection

It’s tricky, though. Data could be exfiltrated by a DNS lookup or OCSP request.

I'm not familiar with OCSP, but DNS happens via UDP, and since parent said "network access", I'm assuming they mean all network protocols, not just TCP.

Re: PyPI: Python packets steal AWS keys from users

#55

Post by kortilla »

capableweb wrote: post #54
fmajid wrote: post #53

Earlier quoted context omitted.

It’s tricky, though. Data could be exfiltrated by a DNS lookup or OCSP request.

I'm not familiar with OCSP, but DNS happens via UDP, and since parent said "network access", I'm assuming they mean all network protocols, not just TCP.

Any access to resolve global dns lets you exfiltrate even if you’re locked to a local resolver. Just blocking connections to the internet directly is not enough.

Re: PyPI: Python packets steal AWS keys from users

#56

Post by oblio »

rjh29 wrote: post #50
codedokode wrote: post #47

Earlier quoted context omitted.

As I understand, they use static analysis. So the malicious code can be hidden by obfuscation. For example, instead of writing open('/etc/password') One can write method = calculateMethodName() name = calculateEtcPassword() geattr(__builtins__, method)(name)

I guess you'd have to run it in a malware sandbox like Cuckoo.

Turns out, stuff like Java's SecurityManager:https://docs.oracle.com/javase/7/docs/api/java/lang/Security... were there for a reason.

Note, it's been around since JDK 1.0, so 1996, 28 years ago (!), though it's not widely used.

But it allows sandboxing of libraries you use. I was using it to make a faulty library that was calling System.exit(0) - yes, a library that was shutting down the entire process, closing the main app... - not do that and instead wrap the exit in a regular exception.

Python and especially Javascript are reinventing a lot of "enterprise" ideas that Java invented 20+ years ago. Maven groupIds are another example from the Java ecosystem (they're used to avoid top level package name squatting).

Re: PyPI: Python packets steal AWS keys from users

#58

Post by Beltiras »

paskozdilar wrote: post #29
lovelearning wrote: post #28

In Linux, is there a secure, but also convenient and user-friendly, way to prevent processes from having the same default level of access to the filesystem as the human user? I like Android's system of per-app uid/gid. But AFAIK it's not implemented by any mainstream Linux kernel or distro. There's AppArmor, but the last time I tried it, I came away with the opinion that it's not very convenient or user-friendly. Per…

Containerization is what you want. There are many containerization tools for Linux, Docker being the most popular, and systemd-nspawn being the most Linuxy, but a bit unknown.

Also: don't install curl in your container.

Re: PyPI: Python packets steal AWS keys from users

#59

Post by Beltiras »

Pv9KKy3 wrote: post #5
anonymousnotme wrote: post #3

Glad they were able to automatically detect/catch this. There seems to be so much bloat when dependencies get pulled in. Wonder if something like pledge and unveil around library code could be helpful; perhaps library code needs to be separated out into a separate process that would not have reason to access AWS keys. Also, looking at the screenshot, could a simple programming searching for URLs in the library code h…

Yeah, I'd love to have a decorator at the top of a file - @env to provide access to env variables or @secrets for some kind of secrets access, nothing else gets this. Python is tough though, a very dynamic language so probably kind of hard to lock it down.

You would normally be able to solve things like this via file permissions in the OS but currently we are running everything as root inside a container.

Re: PyPI: Python packets steal AWS keys from users

#60

Post by makmanalp »

oblio wrote: post #56
rjh29 wrote: post #50

Earlier quoted context omitted.

I guess you'd have to run it in a malware sandbox like Cuckoo.

Turns out, stuff like Java's SecurityManager: https://docs.oracle.com/javase/7/docs/api/java/lang/Security... were there for a reason. Note, it's been around since JDK 1.0, so 1996, 28 years ago (!), though it's not widely used. But it allows sandboxing of libraries you use. I was using it to make a faulty library that was calling System.exit(0) - yes, a library that was shutting down the entire process, closing the…

You are of course correct that those features are extremely useful and that the JDK authors foresaw these situations long before they were a big deal. But also you do note that it's not widely used which is also correct and that's the important bit. I think it would be more accurate to say that python and javascript are discovering (perhaps not fully intentionally) ways to implement these ideas that are suitable for mass community adoption.

IMHO it's like the difference between basic research (mostly not very useful on its own but extremely important) and public health in medicine (the thing that actually makes a massive impact on the world that leverages the former but at a slower and more controlled pace). To stretch the analogy even more any doctor worth their salt will tell you that a treatment plan is only as good as the likelihood that the patient will stick to it. Other things like let's encrypt (https everywhere) and signal/whatsapp/telegram (strong privacy enabled by default) come to mind as implementing ideas on things that experts had been handwringing for decades that people "should" be doing that are now done so well that it feels almost silly not to do them the good way.

Post reply on HN