4 ms·
One thing I've always thought would be a good idea is a tool (either local or part of the pip/other packet manager download process) that greps and prints out a
by keyP 7y ago
One thing I've always thought would be a good idea is a tool (either local or part of the pip/other packet manager download process) that greps and prints out all URLs and IP addresses within the code, including common encodings. Additionally, any lines that uses any transfer protocols (like HTTP requests) should be highlighted too as IP/urls can be encoded. Any HTTP request, for example, to suspiciously encoded URLs could raise flags.
The official library itself could have a "urls" file which has a list of urls that are expected and so anything that doesn't match can be questioned.
Whilst this won't solve the issue 100%, it raises the difficulty barrier to implement outgoing network calls.
- jstanley 7y ago> it raises the difficulty barrier to implement outgoing network calls. Not very much. You just obfuscate your code until this tool doesn't notice anything untoward, and then upload it.
- keyP 7y agoHighly obfuscated code would raise suspicions, especially in similar cases found in NPM packages. E.g. in Python, obfuscators I've come across tend to replace characters with non-Latin unicode chars, which should raise flags when found in a predominatenly latin based source code.
- jstanley 7y agoOnly if a person is looking at it. If the only thing looking at it is a machine, then you can keep iterating until the machine doesn't notice anything.
- keyP 7y agoI agree, it's no where near bulletproof, but it's about raising barriers as well as updating the tool once workarounds are found. I don't see an easy solution to this issue but in most of the cases (including the ones in this article) I've seen to date, a simple URL scan would've caught them let alone more complex methods.