Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dozens of malicious PyPI packages discovered targeting developers

blog.phylum.io

Post reply on HN
Print view View original

91–100 of 334 posts

Re: Dozens of malicious PyPI packages discovered targeting developers

#91

Post by iudqnolq »

daedalus_f wrote: post #89
iudqnolq wrote: post #85

Earlier quoted context omitted.

> People do not expect the compiler to be susceptible to malware attacks I'm not familiar with D, so I'll use the example of Rust. My usual workflow looks something like this 1. Make some changes 2. Either use `cargo test` to run my tests or `cargo run` to run my binary. In both those cases the code is first compiled and subsequently run. I care if running that command gives me malware. I don't care at what step it h…

Perhaps it’s about responsibility. It’s not the compilers fault if you chose to compile and run malware. But you could blame the compiler if it ran malware during the compilation process.

All else equal I'd agree. But I'm perplexed why people spend a lot of effort on what seems to me like a purely philosophical benefit.

Re: Dozens of malicious PyPI packages discovered targeting developers

#92

Post by louislang »

zmaurelius wrote: post #90

I am really surprised that there haven't been even more malicious packages distributed in the past couple of years considering the rise of cryptocurrency. Seems like a determined and malicious actor could score big by targeting the more popular wallets.

It's totally happening. We've seen packages targeting a lot of the big exchanges. Most of the packages are targeting developers directly though; attempting to exfil the users wallets/keys.

Re: Dozens of malicious PyPI packages discovered targeting developers

#93

Post by neurostimulant »

avian wrote: post #60
banana_giraffe wrote: post #26

Earlier quoted context omitted.

It downloads a script that, at least right now, will turn around and grab cookies and passwords from browsers and send the data off to an discord webhook.

> discord webhook Hah. Is this true? I find it funny since IRC has/had this reputation for being a means of communication with malware and it's often blocked on this grounds. Nice to know that malware is going on with the times and is using Discord for that now.

Discord is great as command and control server because the malware author doesn't need to expose their ip address or implement a complex web of proxy to secure their C&C server.

Re: Dozens of malicious PyPI packages discovered targeting developers

#95

Post by ratmice »

iudqnolq wrote: post #85
WalterBright wrote: post #74

Earlier quoted context omitted.

It means you don't need to run the compiler in a sandbox. People do not expect the compiler to be susceptible to malware attacks, and I do what I can to live up to that trust. I haven't heard of anyone creating a malicious source file that would take advantage of a compiler bug to insert malware, but there have been a lot of such attacks on other unsuspecting programs, like those zip bomb files.

> People do not expect the compiler to be susceptible to malware attacks I'm not familiar with D, so I'll use the example of Rust. My usual workflow looks something like this 1. Make some changes 2. Either use `cargo test` to run my tests or `cargo run` to run my binary. In both those cases the code is first compiled and subsequently run. I care if running that command gives me malware. I don't care at what step it h…

With rust quite often (e.g. if you are running rust_analyzer) it will run `cargo check`, to produce errors. When `cargo check` is run, build.rs compiled and run. So quite often by step 1, just opening the file in your editor before even making any changes code is compiled and run.

Walter's solution here allows the compiler to be used by the editor without the editor being susceptible. Which at the very least negates the need for a pop-up in your editor asking for permission.

Re: Dozens of malicious PyPI packages discovered targeting developers

#96

Post by rnk »

iudqnolq wrote: post #91
daedalus_f wrote: post #89

Earlier quoted context omitted.

Perhaps it’s about responsibility. It’s not the compilers fault if you chose to compile and run malware. But you could blame the compiler if it ran malware during the compilation process.

All else equal I'd agree. But I'm perplexed why people spend a lot of effort on what seems to me like a purely philosophical benefit.

It's just address part of the problem, which of course is why it seems somewhat pointless. I need to:

1. Install packages/deps/libraries etc safely

2. Run code that includes those libraries that limits their capabilities centrally.

Re: Dozens of malicious PyPI packages discovered targeting developers

#97

Post by [deleted] »

woodruffw wrote: post #57
sigg3 wrote: post #7

It's using base64 encoded strings to deliver the initial stage. Can this be avoided/flagged more easily if by adding a scan of statements featuring base64 or import?

We tried doing this on PyPI a couple of years ago, and it produced a large number of false positives (too many to manually review). You can see the rules we tried here[1]. [1]: https://github.com/pypi/warehouse/blob/main/warehouse/malwar...

[deleted]

Re: Dozens of malicious PyPI packages discovered targeting developers

#98

Post by SamuelAdams »

alexb_ wrote: post #70

A lot of people in this thread are asking for a reputation/"verified user" solution for this, but really I think just pulling a gazillion dependencies for applications is just all around bad. I actually think having a reputation system would be even worse, because people would see it and assume that reputation is a guarantee of safety. Trust without verification is where issues can become even worse.

So is .NET finally going to make a comeback? Yes, you need some dependencies for projects, but in general Microsoft does a good job providing a lot of tooling and libraries.

Re: Dozens of malicious PyPI packages discovered targeting developers

#99

Post by [deleted] »

iudqnolq wrote: post #85
WalterBright wrote: post #74

Earlier quoted context omitted.

It means you don't need to run the compiler in a sandbox. People do not expect the compiler to be susceptible to malware attacks, and I do what I can to live up to that trust. I haven't heard of anyone creating a malicious source file that would take advantage of a compiler bug to insert malware, but there have been a lot of such attacks on other unsuspecting programs, like those zip bomb files.

> People do not expect the compiler to be susceptible to malware attacks I'm not familiar with D, so I'll use the example of Rust. My usual workflow looks something like this 1. Make some changes 2. Either use `cargo test` to run my tests or `cargo run` to run my binary. In both those cases the code is first compiled and subsequently run. I care if running that command gives me malware. I don't care at what step it h…

[deleted]

Re: Dozens of malicious PyPI packages discovered targeting developers

#100

Post by mlyle »

iudqnolq wrote: post #84
pletnes wrote: post #73

Earlier quoted context omitted.

CI/CD servers, dev laptops etc could have more privileges than the production machines. For instance.

So you never run tests on your dev machine or CI/CD, and never run your code to manually test? I'm not experienced but I thought it was normal to have some way to try out what you've written on your dev machine. Is everyone else stepping through code in their head only, and their code is run for the first time when it's deployed to production?

Your dev machine getting pwned is bad, but your CI server getting screwed up is worse.

This way you don't need to sandbox the compiler, and it can freely use system resources and access source trees. You only need to sandbox the execution.

(As some people point out in this thread, editors are starting to use compilers to get overall meta-information, too-- if you can't even -view the code- to tell if it's malicious without getting exploited, that's bad).

Post reply on HN