18 ms·
3500 packages uploaded to PyPI, pointing to a malicious URL
- ricardobayes 6y agoAny way to know how many times were the packages accessed?
- oli5679 6y agohttps://github.com/pypa/pypi-support/issues/923 https://github.com/pypa/pypi-support/issues/923 "The package only contains __init__.py file, that says: # the purpose is to make everyone pay attention to software supply chain attacks, because the risks are too great."
- jlgaddis 6y agoDid you miss the statement (and relevant code snippet) immediately preceding that? > The project contains a setup.py file that sends a request to a malicious URL during installation. I can't comment on whether the URL is actually malicious or, perhaps, just logging requests for statistics / tracking.
- dthul 6y ago"Sends a request to a malicious URL". Malicious is relative of course. The code reads: url = "http://101.32.99.28/name?<package_name>" requests.get(url, timeout=30) So it looks like the author wants to track the number of installs. Nothing is done with the response value (at least for the setup.py that I saw). Edit: seems to be a Tokyo based IP.
- sodality2 6y agoThe IP is from "Tencent Building, Kejizhongyi Avenue". That's weird, if it was just because they were an ISP, why would it say "Tencent Building"? https://ipapi.co/101.32.99.28/ https://ipapi.co/101.32.99.28/
- capableweb 6y agoUltimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)
- dthul 6y agoThat surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not. Unrelated tidbit: tencent.com returns an empty reply for me at the moment.
- capableweb 6y ago> tencent.com returns an empty reply for me at the moment That's because the correct address is https://www.tencent.com/ https://www.tencent.com/ (prefixed with www.)
- dthul 6y agoOh, nice catch! Strange setup.
- sodality2 6y agoWow. Can the massive chinese conglomerate really not forward that to www?
- basilgohar 6y agoThey are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.
- deelowe 6y ago
- genmon 6y agoAssuming requester IPs are being logged, this is a good way to build a map of potentially vulnerable organisations. No need to do anything now.
- ztgasdf 6y agoI went to the IP and it sent a single file (1B) containing a line break. I don't know if they changed it recently, but that's what happens on that URL right now.
- jlgaddis 6y agoUsing which HTTP client? To test "correctly", you'd likely want to use the requests library or, at the least, ussend the same User-Agent header that it does. (And, for all we know, they could just be targeting certain IP addresses... or only responding the "malicious" response the first time the URL is requested per IP... or some other weird conditions that we aren't aware of.)
- sodality2 6y agoIt returns a null binary. Of course, this could be a targeted attack though.
- dthul 6y agoThe setup.py that I saw doesn't do anything with the response of the HTTP request so if it were indeed a targeted attack it would need to exploit some kind of weakness in the network stack. I guess that makes a targeted attack quite unlikely.
- oli5679 6y agoHi thanks for sharing. The above I noticed and I thought it was captured quite well by the title. Thank you for flagging though it is useful context. My overall assessment is that this is grey/whitehat but merits further investigation.
- LinuxBender 6y agoIf we are being honest, nobody here can really answer that. The requests can act benign until the attacker chooses to change the payload based on source IP, time of day, source network, user-agent, etc... I believe it is best to block any outbound network connection you did not define in your code. e.g. your code uses a filtering proxy for approved API destinations.
- teddyh 6y agoThe user account in question is named “RemindSupplyChainRisks”, so it’s pretty clearly at most a grey-hat scenario.
- naniwaduni 6y agoYou may be surprised to learn that even bad actors can choose innocuous names! They often don't if coming up with and maintaining names tends to be more expensive than it's worth when you're just going to burn them as they get caught, but it's totally viable for e.g. a targeted scenario.
- teddyh 6y agoI would think that an actual bad actor would choose an inconspicuous name, not a clear “IAmAGreyHat” name. But, of course, that’s what they’d want me to think, so who knows.
- minitoar 6y agoI would simply name myself IocainePowder
- luismedel 6y agoContinue and soon you’ll end playing an intelligence challenge in front of a iocaine-poisoned glass of wine :-)
- yborg 6y agoJokes' on them, I've spent the last few years building up an immunity to iocaine powder.
- ivanbakel 6y agoWhat would be an inconspicuous name in this scenario? Unannounced typo-squatting is at best a greyhat activity - as the urban legend goes, better to be caught shagging the sheep than rustling it.
- instance 6y agoAssuming the 'malicious' URL is really just statistics collection, I am really interested about the post we will hopefully get next week, with a few nice plots.
- rossdavidh 6y ago1) surely there's a better way to draw attention to this kind of risk...right? 2) I admit they have my attention, but now what?
- warmwaffles 6y agoCauses development teams to update roles on who is allowed to do what and package signing.
- Isinlor 6y agoAdd namespaces? Block adding new packages that are not named "vendor-packagename" and ensure that only one entity can own a vendor name.
- CapriciousCptl 6y agoHere’s cupy’s postmortem— https://github.com/cupy/cupy/issues/4787 https://github.com/cupy/cupy/issues/4787 Salient points being that cupy releases a new named package for each cuda version, so future package names are of course predictable. Since PyPi doesn’t allow namespacing, cupy’s plan is to register new names ASAP when cuda releases a new version and monitor and report other packages purporting to be cupy that get uploaded.
- alisonkisk 6y agoWhy not pre-register? Why wouldn't attacker pre-register?
- SloopJon 6y agoThat's interesting. There is a policy and process (PEP 541) in place for addressing this, and it seems to have been executed swiftly and responsibly. Is this incident an argument for namespacing, or that the status quo is good enough? I feel like domain name disputes tilt disproportionately to trademark holders, so I wouldn't like to see, e.g., cupy block a cupyd package or vice versa (or, for that matter, NVIDIA somehow strongarm cupy). On the other hand, you'd like a mechanism by which you can trust that a package comes from the cupy maintainers.
- xapata 6y ago> PyPi doesn’t allow namespacing Yet. I suppose it might wind up vaporware, but the feature request is under discussion/development. BTW, it's PyPI.
- tantalor 6y ago"Someone"? Why don't public package managers like PyPI & npm require package owners to publish their real names and verify their identify, similar to WHOIS?
- ajarmst 6y agoA lot of the maintenance of these packages is performed by volunteers. Putting, however well-intentioned, barriers up will often result not in a more secure maintenance process but no maintenance at all. I'm generally happy to donate my patch that fixes an issue in a package I use, but that's not going to last long in the face of demands that I jump through hoops prove my identity (my interest in the following the bureaucratic procedures of an organization is closely related to the amount of money they are paying me). Particularly since my experience has been that organizations that are anal about that sort of confirmation tend to be more interested in passing any legal liability on to me rather than maintaining a secure maintenance process.
- tantalor 6y agoYou misunderstand me. I don't think every single code contributor needs to divulge their identity. Only the package owner (one person) needs to vouch for the code in the package by putting their name on it. That person may have written none of the code, but they should be accountable for it. This is similar to how websites have domain owners.
- dgjdfhsdfh 6y agoSo you can sue them should their account get taken over or for other reasons? Or so that people can harass maintainers they do not like easier? Looks like unneeded legal risks with no reward given people can already reveal their name if they want to.
- tantalor 6y agoThe reward is improved security for the whole ecosystem because anonymous trolls will be discouraged from uploading garbage packages.
- omginternets 6y agoDidn't this happen a few years back as well (circa 2012)?
- RocketSyntax 6y agoit's a bit crazy how easy it is to upload executables
- erichurkman 6y agoThis looks like someone trying to replicate Alex Birsan's attack on Apple, Microsoft, and others but through package confusion instead of version squatting. Reasonable speculation: 1. Host thousands of typo packages that phone home every time they are installed. Store IPs. 2. Find which companies own those IPs, filter out residential 3. Report vulnerabilities [0] https://news.ycombinator.com/item?id=26087064 https://news.ycombinator.com/item?id=26087064
- soheil 6y agoHow hard is it to use a VPN?
- moviuro 6y agohttps://incolumitas.com/2016/06/08/typosquatting-package-managers/ https://incolumitas.com/2016/06/08/typosquatting-package-man... https://news.ycombinator.com/item?id=11862217 https://news.ycombinator.com/item?id=11862217
- uranusjr 6y agoAlex Birsan’s attack was much more involved and raised issues less recognised by a vast number of communities members. This one is basically typosquatting, a well known issue that Birsan’s manoeuvre did not focus on.
- alisonkisk 6y agoRemember the 1990s when everyone mocked MS Outlook for downloading and running unverified software automatically? Now Linux programmers do that intentionally via package managers.
- NateEag 6y agoLinux programmers realize that's what they're doing. Outlook users probably didn't, most of the time.
- superluserdo 6y agoIt's not unverified if it comes from an actually curated package repository, like the one on any given Linux distro. "Package maintainer" isn't just obsolete busywork, it's an essential part of a robust security model IMO.
- macksd 6y agoOne of the things that the recent Python cryptography debate has highlighted to me is how much we depend on this distribution of libraries like this. In that case, it's normal to just automatically get updates from a product and then one day, a whole bunch of software projects suddenly notice and, luckily, break (lucky, as opposed to being compromised). In this case, it's normal to just type a project name in install software, with very little vetting done by many people. I want to work on someone's web app, npm suddenly downloads the world. Who's actually audited all that? I know I haven't. Not sure how we could fix it without slowing way down and doing a lot more work.
- ryanmarsh 6y agoWho's actually audited all that? I'm sure it's insufficient but you asked who audits all that (re: npm) well, apparently somebody. https://docs.npmjs.com/cli/v7/commands/npm-audit https://docs.npmjs.com/cli/v7/commands/npm-audit The audit command submits a description of the dependencies configured in your project to your default registry and asks for a report of known vulnerabilities. If any vulnerabilities are found, then the impact and appropriate remediation will be calculated. If the fix argument is provided, then remediations will be applied to the package tree.
- jhardy54 6y agoThis provides a list of well-known vulnerabilities, it doesn't actually audit the source code to find unknown vulnerabilities.
- tux1968 6y agoThe only practical way is to have a centralized vetting organization that can give a trusted stamp of approval to signed packages. That would still slow things down, but at least wouldn't require duplication of work by everyone on a massive scale. You could outsource your vetting work to a distribution you trust.
- artful-hacker 6y agoI was trying to find a solution to this problem for my organization and came across https://tidelift.com/ https://tidelift.com/. I like some of their ideas and think it's a solid path forward at chipping away on this issue. https://libraries.io/ https://libraries.io/ is a project of theirs I use quite often when vetting third party dependencies for our organization.
- rainworld 6y agoHow about: Packages are namespaced and "tier 2" by default. Official packages, packages from trusted vendors, might-as-well-be-in-the-stdlib packages, otherwise vetted packages, are upgraded to "tier 1", might drop the namespace. Project manifests can specify: stdlib only, "tier 1" packages only. The latter sounds like a sane default.
- hiq 6y agoWho decides who is a "trusted vendor", and how? You either give up on a lot of packages or end up in the current situation where everyone is trusted.
- xapata 6y agoWho decides what's "Tier 1"? How will you fund their work? Currently there are a few vendors providing what you're asking for, including Anaconda (https://www.anaconda.com/ https://www.anaconda.com/) and ActiveState (https://www.activestate.com/ https://www.activestate.com/). > Get the most from your use of Perl, Python or Tcl and reduce your compliance, legal, and security risks. We offer custom managed and self-serve distributions, including support and maintenance, on Windows, Linux, AIX and more – even for 32-bit and older releases.
- exegete 6y agoTyposquatting in package repositories (2016) https://lwn.net/Articles/694830/ https://lwn.net/Articles/694830/ Further analysis of PyPI typosquatting (2020) https://lwn.net/Articles/834078/ https://lwn.net/Articles/834078/
- joana035 6y agoThat is why I only get my python packages from Debian repositories ;)
- zajio1am 6y agoThis just illustrates issues with 'one-size-fits-all' approach to code distribution. Compare that with traditional C/Unix way - everyone can push code on their web, but there is no implicit trust associated with such code. Then code may or may not be incuded in separate 'distribution streams' (like Linux distributions), each has its own independent vetting process. C/Unix way avoids centralization of power/trust and also avoids implicit assumption that every code should be in one canonical repository.
- luhn 6y agoWhat makes this exceptionally problematic is pip's behavior of --extra-index-url, commonly used for private indices. To choose between the standard index and the extra index, pip looks at both and takes the one with the higher version. So if an attacker uploads a public package with the same name and a high version, pip will prefer that one. This has actually happened to me, although just by accident and not malintent, and I pin and sign my dependencies so it was caught before it was deployed.
- antihero 6y agoSeems like a great attack vector for disgruntled ex-employees actually. All they'd need to do is copy the source code and names of internal packages, then release public versions with the same names and same source code, but backdoored. Developers likely wouldn't notice because things would function similarly at least for a while.
- prepend 6y agoI think this noise isn’t really a problem unless people misunderstood pypi. Pypi is not a white list, it’s just an index. People shouldn’t randomly download packages without understanding and verifying EVERY one. I think this is lazy devs and users who mixed up the App Store with pypi. These “exploits” aren’t very useful other than helping people understand these problems. It seems like an easy solution that some company could set up to test and verify packages and create a white list service that I could subscribe to. I currently use dependency checkers like safety and snyk that will alert me to real vulnerabilities like when someone takes over a package. That I care about. We’re someone to take over pandas and put malicious code, that would be damaging. That’s also why I pin all packages to specific versions and don’t update unless necessary. I think this can be solved by better training. I worry that these articles are some new form of FUD against Python. So far, I’ve gotten some non-tech security folks ping me about “Python vulnerabilities” because they read these articles. But it’s pretty easy to evaluate if my org is actually at risk by reviewing the dependency graph and seeing that no one is using these 3500 bogus packages.
- nxpnsv 6y agoWell you probably know your top level requirements, but what about their dependencies, and subsequent dependencies? I guess it could happen that a popular package gets corrupted. My current notebook venv has 87 packages installed, I can't vouch for all of them...
- prepend 6y agoFor production uses, I check them all. It’s a pain, but not that hard to do. I also use dependency checkers that monitor al those various packages for CVEs related to particular versions. I think I typically catch them during dev and GitHub does a pretty good job of detecting and even suggesting updates. There is a risk that a package gets corrupted at a used version, but I think that’s fairly small and would be detected quickly. But I think that’s similar to what would happen if Microsoft or Apple put out a bad update. And pypi is policed better than commercial setups that don’t have checks and balances (eg, SolarWinds)
- katbyte 6y ago