4 ms·

I get the python3-dateutil because you might think it's an updated version of the standard library. But how does jellyfish with a different char for L work? So

by Jonnax 7y ago

I get the python3-dateutil because you might think it's an updated version of the standard library. But how does jellyfish with a different char for L work? Someone would need to copy and paste it. But if they go to pypi, it won't have many installs. Unless they started writing tutorials with: "okay now just pip install X"

mixedmath 7y ago
I think the key here is that jeIlyfish had malicious code in it, and the fake python3-dateutil imported jeIlyfish. Even if you were examining the source for malicious code, you might not notice the difference between jellyfish and jeIlyfish, I guess.
xamuel 7y ago
>But if they go to pypi, it won't have many installs If people are using number of installs as a safety metric, can't blackhats game that by having a bot install the package many times?
daolf 7y ago
If I had to guess, I'd say that the JeIlyfish package is just here to wrap the malicious code since JeIlyfish is a dependancy of the compromised python3-dateutil package.
deaps 7y ago
The python3-dateutil listed jeilyfish as a dependency - so I'm guessing that upon installing the fake dateutil, the user would see something like "installing dependency - jeIlyfish" - which, depending on your font, may, at the very least, cause a person to google "python3 what is jellyfish" arriving at a concise description of what jellyfish is from pypi. Then dateutil calls the code in jeilyfish.
noisem4ker 7y ago
Just an idea: in autocomplete scenarios, jeIlyfish comes alphabetically before jellyfish, while looking like it. That could hijack an install. I don't know if and where autocomplete can be used with PIP, though.
zbentley 7y ago
Copy and pasting, even via word of mouth (rather than, say, a blog post or highly-google-ranked tutorial) is a surprisingly viral propagation vector. And god help us if a malicious install command was posted, even if only for a few minutes before being edited, to a help or forum site like StackOverflow or Reddit.
dahart 7y ago
PyCharm, Stallion, Anaconda Navigator, etc... You don’t need to copy and paste it, or go to pypi, since there are commonly used ways to install packages by clicking on the name.

by Jonnax 7y ago

mixedmath 7y ago

I think the key here is that jeIlyfish had malicious code in it, and the fake python3-dateutil imported jeIlyfish. Even if you were examining the source for malicious code, you might not notice the difference between jellyfish and jeIlyfish, I guess.

xamuel 7y ago

>But if they go to pypi, it won't have many installs If people are using number of installs as a safety metric, can't blackhats game that by having a bot install the package many times?

daolf 7y ago

If I had to guess, I'd say that the JeIlyfish package is just here to wrap the malicious code since JeIlyfish is a dependancy of the compromised python3-dateutil package.

deaps 7y ago

The python3-dateutil listed jeilyfish as a dependency - so I'm guessing that upon installing the fake dateutil, the user would see something like "installing dependency - jeIlyfish" - which, depending on your font, may, at the very least, cause a person to google "python3 what is jellyfish" arriving at a concise description of what jellyfish is from pypi. Then dateutil calls the code in jeilyfish.

noisem4ker 7y ago

Just an idea: in autocomplete scenarios, jeIlyfish comes alphabetically before jellyfish, while looking like it. That could hijack an install. I don't know if and where autocomplete can be used with PIP, though.

zbentley 7y ago

Copy and pasting, even via word of mouth (rather than, say, a blog post or highly-google-ranked tutorial) is a surprisingly viral propagation vector. And god help us if a malicious install command was posted, even if only for a few minutes before being edited, to a help or forum site like StackOverflow or Reddit.

dahart 7y ago

PyCharm, Stallion, Anaconda Navigator, etc... You don’t need to copy and paste it, or go to pypi, since there are commonly used ways to install packages by clicking on the name.