Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious software libraries found in PyPI posing as well known libraries

nbu.gov.sk

Post reply on HN
Print view View original

101–110 of 254 posts

Re: Malicious software libraries found in PyPI posing as well known libraries

#101

Post by IshKebab »

IgorPartola wrote: post #15

This to me is the nightmare scenario. Well one of the two, the other one being that a developer of an obscure library I use has their password to PyPI compromised and a bad actor uploads a backdoored version of the library. Fundamentally, the reason this is different from how thinks like Linux distos work is because Linux distros have maintainers who are in charge of making sure every new update to one of their packa…

> Fundamentally, the reason this is different from how thinks like Linux distos work is because Linux distros have maintainers who are in charge of making sure every new update to one of their packages is legit.

How is that different?

Re: Malicious software libraries found in PyPI posing as well known libraries

#102

Post by IgorPartola »

mschuster91 wrote: post #93
raesene6 wrote: post #24

Earlier quoted context omitted.

A review system unfortunately isn't likely to be practicable with current development models. npm alone has over 500,000 packages ( http://www.modulecounts.com/ ) so even a one time review isn't going to happen. If people want a more trusted solution the likely outcome is that they'll need to use a smaller more static set of libraries and then either do the audits themselves, or outsource that to a 3rd party. Ofc wit…

> npm alone has over 500,000 packages ( http://www.modulecounts.com/ ) so even a one time review isn't going to happen. But at least the modules with the most downloads (webpack, react, or stuff like left-pad) could be vetted, and especially npm could implement a 2-or-more person model - basically, everyone with publish access can upload a new artifact, but to actually have it distributed to endusers, a second person…

That's the thing. I worry less about popular packages. I can check that Django's GitHub repo links to PyPI and vice versa. But a random package to parse DSN's? I don't know it from Adam. I want to use it, and lots of others do too, but not everyone is going to review it. Maybe just a button on the package that says "I found insecure code!" Would be good.

Re: Malicious software libraries found in PyPI posing as well known libraries

#103

Post by edraferi »

hannob wrote: post #84

Ok, here's some ugly backstory on this: This problem has been known for a while, yet both the pypi devs and the python security team decided to ignore it. Last year someone wrote his thesis describing python typosquatting and standard library name squatting: http://incolumitas.com/2016/06/08/typosquatting-package-mana... However after that the packages used in this thesis - the most successful one being urllib2 - wer…

I appreciate the proactive approach.

Is your project the author of the packages identified by NBU? If so:

(1) Why is the tracking pingback obfuscated?

(2) Why does the code include a cheeky hello instead of a link to https://www.pytosquatting.org/ ?

(3) Why is there not a visible warning when installing one of these packages?

=================

edit:

Reading through the linked blog post [0], it appears these researchers used different code that DID provide visible warning and an cleartext pingback. It also collected command history and hardware information.

[0] http://incolumitas.com/2016/06/08/typosquatting-package-mana...

Re: Malicious software libraries found in PyPI posing as well known libraries

#104

Post by eeZah7Ux »

collyw wrote: post #75
kasabali wrote: post #53

Yet another attack vector that doesn't exist at all in Linux distributions but invented by language package managers, sadly. They solved the issue 2 decades ago by heavily vetting packages before accepting them into repositories. Users are allowed to add and use packages from 3rd party repositories. Maybe solution to this is creating curated repositories based on publicly open ones and using them by default (and requ…

Sure its nice (and easier) to use the distro's package management system, but it often just isn't up to date enough. You end up using thing that are a while out of date and may have security flaws as a result.

> using thing that are a while out of date and may have security flaws as a result

On the contrary, on distributions that perform security updates the level of security of a package can only increase over time.

It might sound obvious but vulnerabilities are created in new releases, while vulns in existing packages can be only be found and fixed, not created.

(Of course I'm talking only about vulnerabilities here and excluding removal of obsoleted crypto or addition of new security features)

Re: Malicious software libraries found in PyPI posing as well known libraries

#105

Post by 1ba9115454 »

wiradikusuma wrote: post #67

Anyone know if this is also an issue for Java? I've used Maven repository for ages, and I know many big cos depend on it.

It's absolutely an issue. I'm pretty sure no one is looking at every jar file added to maven to see if there's an issue.

In your POM file do you have a checksum?

Re: Malicious software libraries found in PyPI posing as well known libraries

#106

Post by 1ba9115454 »

Unless your package manager enforces signatures and you trust the person that signed the package. Then this is an attack vector for you.

That includes Java (Maven), Ruby (Gems, Bundler), Node (npm), Haskel (stack) etc etc.

Installing code via package managers is the coders equivelant of opening up an exe sent to you in an email.

Code downloaded from the internet is not to be trusted.

Re: Malicious software libraries found in PyPI posing as well known libraries

#107

Post by eeZah7Ux »

IshKebab wrote: post #100
kasabali wrote: post #53

Yet another attack vector that doesn't exist at all in Linux distributions but invented by language package managers, sadly. They solved the issue 2 decades ago by heavily vetting packages before accepting them into repositories. Users are allowed to add and use packages from 3rd party repositories. Maybe solution to this is creating curated repositories based on publicly open ones and using them by default (and requ…

The Linux distribution approach to package management ("we'll package everything ourselves!") simply doesn't scale.

That's a feature. You want a set of vetted and curated packages you can trust, and you want to receive security updates on them.

Re: Malicious software libraries found in PyPI posing as well known libraries

#108

Post by atticusberg »

to see if you have any of these deps on your python path:

pip list –format=legacy | egrep -e '^acqusition$' -e '^apidev-coop$' -e '^bzip$' -e '^crypt$' -e '^django-server$' -e '^pwd$' -e '^setup-tools$' -e '^telnet$' -e '^urlib3$' -e '^urllib$'

to see if you have any projects in a given directory that require them:

cat $(find /path/to/dir -name 'requirements.txt') | egrep -e '^acqusition==' -e '^apidev-coop==' -e '^bzip==' -e '^crypt==' -e '^django-server==' -e '^pwd==' -e '^setup-tools==' -e '^telnet==' -e '^urlib3==' -e '^urllib=='

Re: Malicious software libraries found in PyPI posing as well known libraries

#109

Post by eeZah7Ux »

gkya wrote: post #98
raesene6 wrote: post #36

Earlier quoted context omitted.

Not a typo, http://www.modulecounts.com/ has the details. npm is adding 497/day at the moment.

This [1] is npm growth compared to anything else. God this can't be safe nor sane... [1] https://imgur.com/a/enjvR

The left-pad disaster has been predicted well in advance...

Re: Malicious software libraries found in PyPI posing as well known libraries

#110

Post by dagw »

mikeyjk wrote: post #82
collyw wrote: post #75

Earlier quoted context omitted.

Sure its nice (and easier) to use the distro's package management system, but it often just isn't up to date enough. You end up using thing that are a while out of date and may have security flaws as a result.

This is incorrect of rolling release distros. Even Ubuntu is fairly quick to update, which is not a rolling release. CentOS on the other hand can be like pulling teeth. I'm going to be glad to stop dealing with CentOS 6.

Ubuntu is fairly quick to update

For popular packages perhaps, but for many more obscure and niche python packages Ubuntu is often a several releases behind, and that is if there even exists a package to begin with

Post reply on HN