Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious software libraries found in PyPI posing as well known libraries

nbu.gov.sk

Post reply on HN
Print view View original

11–20 of 254 posts

Re: Malicious software libraries found in PyPI posing as well known libraries

#11

Post by nariinano »

dpflan wrote: post #6

This is interesting in conjunction with the recent post about Python's popularity because that may be a weakness exploited here [1.]. It's easy to use and install and get libraries for anything, and apparently libraries for infecting your machine :(. [1.] https://news.ycombinator.com/item?id=15249348

The problem is that the vetting process of PyPI is completely inexistant. This has happened many times in the past, the last time I remember they uploaded a few libraries called "bs4" and stuff like that.

Re: Malicious software libraries found in PyPI posing as well known libraries

#12

Post by chatmasta »

Package managers seem to be an increasingly popular attack vector. It's only luck that none of the attacks have been particularly malicious yet. Considering how many package manager downloads go to a server in a datacenter, a widely distributed malicious package could control a botnet with extremely high throughput, or wreak havoc on any databases it comes into contact with.

It's only a matter of time before something like this happens. A big part of the problem is that application package managers, like pip or npm, are far less sophisticated than those of operating systems, like aptitude or yum. It needs to be easy for developers to open source their code, and to mark dependencies with precise commit hashes, but the download also needs to be secure and verifiable. There are many difficult tradeoffs to consider in terms of usability, centralization, security and trust.

Re: Malicious software libraries found in PyPI posing as well known libraries

#14

Post by rantanplan »

tobltobs wrote: post #10
rantanplan wrote: post #3

The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.

Not for me. There is space at the end between the closing bracket and the apostrophe. Maybe you did remove this space when you corrected the smart apostrophes.

You're right. It seems I did remove the space. When I put it back in it doesn't print anything.

Re: Malicious software libraries found in PyPI posing as well known libraries

#15

Post by IgorPartola »

This to me is the nightmare scenario. Well one of the two, the other one being that a developer of an obscure library I use has their password to PyPI compromised and a bad actor uploads a backdoored version of the library.

Fundamentally, the reason this is different from how thinks like Linux distos work is because Linux distros have maintainers who are in charge of making sure every new update to one of their packages is legit. I am sure you can try to sneak malicious code in, but it isn't going to be easy.

I am not advocating that PyPI (and npm) adopt the same model. That would be too restrictive. But maybe just showing the number of downloads isn't the best way to assure whether the package is legit. Perhaps some kind of built in review system would be nice.

Re: Malicious software libraries found in PyPI posing as well known libraries

#16

Post by rantanplan »

nariinano wrote: post #8
rantanplan wrote: post #3

The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.

I believe urllib3 is built-in. So if you have installed it from PyPI you've gotten a malicious version.

https://pypi.python.org/pypi/urllib3

Re: Malicious software libraries found in PyPI posing as well known libraries

#19

Post by julianwachholz »

b101010 wrote: post #4
a3n wrote: post #2

Dry run?

The "malicious" code at the end of the advisory looks like nothing more than a beacon announcing it was installed? edit: get current working directory get username get hostname concatenate the last 3 together obfuscate(/encrypt?) this string send the result as a http request to 121.42.217.44 (the value of the base64 string)

# Welcome Here! :)

# just toy, no harm :)

Re: Malicious software libraries found in PyPI posing as well known libraries

#20

Post by cpburns2009 »

nariinano wrote: post #8
rantanplan wrote: post #3

The regex they have for identifying fake/harmful packages is wrong. `pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '` This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages. [UPDATE] Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.

I believe urllib3 is built-in. So if you have installed it from PyPI you've gotten a malicious version.

urllib and urllib2 are built-in for Python 2, and were merged and reorganized as just urllib in Python 3. urllib3 is a third-party module.
Post reply on HN