Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Python malware on the rise

cyborgsecurity.com

Post reply on HN
Print view View original

11–20 of 70 posts

Re: Python malware on the rise

#11

Post by staticassertion »

grawprog wrote: post #9

This seemed to be more about how to compile/decompile and obfuscate Python code then anything about malware. The two examples were the ability to take screenshots and make web requests were the only two actual potential malware related topics, but even those are fairly basic concepts that have a huge range of applications outside malware. These things are also fairly trivial in most even slightly mature languages. Th…

I think you're talking about something very different, which is attacking Python's supply chain.

This is talking about malware payloads themselves. I don't agree that those capabilities (taking screenshots, especially eval) are trivial in other languages. Eval in particular makes things trivial since you can basically do:

eval(get_payload()), which is awesome from a staging perspective - the trend in malware is to modularize more and more for a number of reasons (less code to scan for sigantures, new monetization strategies, easier to update, etc).

So having the ability to do runtime, reflective module loading to trivially get a capability like screenshotting is pretty huge.

Re: Python malware on the rise

#12

Post by theturingnerd »

vesche wrote: post #5
neatze wrote: post #3

This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)

Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed. As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the…

Quality work! Sidebar, it's crazy to see you on the front page of HN; hope you're doing well man! --t--

Re: Python malware on the rise

#13

Post by neatze »

vesche wrote: post #5
neatze wrote: post #3

This article lost me, what really confuses me is exceptions in malware with obfuscated code example (I would not call this obfuscated code) and "import cv2" example, does malware installs open-cv library on windows in background ? (this simply does not compute)

Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed. As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the…

Thanks for article and explanation I am less confused now.

I wonder how large malware payload size will be when packaged with open-cv :)

Re: Python malware on the rise

#14

Post by vesche »

neatze wrote: post #13
vesche wrote: post #5

Earlier quoted context omitted.

Author here. The obfuscated code example was to show what a malware author might do to make malware analysis of a Python "compiled" binary more difficult. The code might be obfuscated & turned into an executable before deployed. As far as the opencv library goes, used by PoetRAT, you can choose to bundle third party packages inside your executable with all the executable generators I mentioned at the beginning of the…

Thanks for article and explanation I am less confused now. I wonder how large malware payload size will be when packaged with open-cv :)

They can get really large, especially if it's a dependency that has many dependencies itself! Glad you enjoyed it, thanks so much for reading.

Re: Python malware on the rise

#17

Post by easterncalculus »

klyrs wrote: post #2

Is it just me, or does this read like a friendly howto for a would-be python malware author?

Sure, but that's the standard for just about anything infosec related on the internet. Blog posts tend to reveal what techniques are in use as it's usually in the best interest of defenders.

Furthermore, red teams being kept up to date is also useful, which might be more surprising to those surprised by this post. Knowing obfuscation techniques in particular is plenty useful to developers and cybercriminals alike.

Re: Python malware on the rise

#18

Post by easterncalculus »

grawprog wrote: post #9

This seemed to be more about how to compile/decompile and obfuscate Python code then anything about malware. The two examples were the ability to take screenshots and make web requests were the only two actual potential malware related topics, but even those are fairly basic concepts that have a huge range of applications outside malware. These things are also fairly trivial in most even slightly mature languages. Th…

I think your last point and the article's points reflect two different contexts though. One is attacking python software with malicious libraries, while the article's context is python being used to attack any system, even systems that don't have an interpreter installed.

That being said, the security of PyPi and python packaging in general is certainly another interesting topic. I like to think that so far it hasn't been as bad as NPM, but there have been backdoored packages put out onto the internet. It's bound to happen with any public software repo, and with any project that trusts outside contributors without perfect review.

Re: Python malware on the rise

#19

Post by easterncalculus »

This is a very interesting article, and it is somewhat surprising to see Python entering the malware space more in recent years. Other compiled languages with sophisticated runtimes and cross platform support fit in quite well (Go especially) but to see Python is quite interesting. I guess these actors are at a point where they can churn it out relatively quickly, and are not too worried about the code being reversed rather trivially.

What I'd want to learn more about is whether or not these Python samples tend to be very large (in terms of actual code, and not just language internals/pyinstaller/boilerplate). I expected the real life samples to be smaller than some of the larger botnets and the like written in these compiled languages, but some of the ones you go in depth on are somewhat surprising.

Re: Python malware on the rise

#20

Post by staticassertion »

easterncalculus wrote: post #19

This is a very interesting article, and it is somewhat surprising to see Python entering the malware space more in recent years. Other compiled languages with sophisticated runtimes and cross platform support fit in quite well (Go especially) but to see Python is quite interesting. I guess these actors are at a point where they can churn it out relatively quickly, and are not too worried about the code being reversed…

For what it's worth Go is also gaining traction, from what I can tell. Malware authors do not appear to be particularly afraid of trying new languages.
Post reply on HN