5 ms·
https://github.com/pypa/pypi-support/issues/923 https://github.com/pypa/pypi-support/issues/923 "The package only contains __init__.py file, that says: # the
by oli5679 6y ago
https://github.com/pypa/pypi-support/issues/923 https://github.com/pypa/pypi-support/issues/923
"The package only contains __init__.py file, that says:
# the purpose is to make everyone pay attention to software supply chain attacks, because the risks are too great."
- jlgaddis 6y agoDid you miss the statement (and relevant code snippet) immediately preceding that? > The project contains a setup.py file that sends a request to a malicious URL during installation. I can't comment on whether the URL is actually malicious or, perhaps, just logging requests for statistics / tracking.
- dthul 6y ago"Sends a request to a malicious URL". Malicious is relative of course. The code reads: url = "http://101.32.99.28/name?<package_name>" requests.get(url, timeout=30) So it looks like the author wants to track the number of installs. Nothing is done with the response value (at least for the setup.py that I saw). Edit: seems to be a Tokyo based IP.
- sodality2 6y agoThe IP is from "Tencent Building, Kejizhongyi Avenue". That's weird, if it was just because they were an ISP, why would it say "Tencent Building"? https://ipapi.co/101.32.99.28/ https://ipapi.co/101.32.99.28/
- capableweb 6y agoUltimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)
- dthul 6y agoThat surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not. Unrelated tidbit: tencent.com returns an empty reply for me at the moment.
- capableweb 6y ago> tencent.com returns an empty reply for me at the moment That's because the correct address is https://www.tencent.com/ https://www.tencent.com/ (prefixed with www.)
- dthul 6y agoOh, nice catch! Strange setup.
- sodality2 6y agoWow. Can the massive chinese conglomerate really not forward that to www?
- basilgohar 6y agoThey are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.
- deelowe 6y agoSeems to be working as intended, it's a non www url.
- sodality2 6y agoI rarely see a site that doesn't redirect it to the appropriate subdomain. Then again I don't often check it unless it's broken
- 6y ago
- robjan 6y agoLooks like the first line of the address for the headquarters of Tencent Cloud in Shenzhen.
- genmon 6y agoAssuming requester IPs are being logged, this is a good way to build a map of potentially vulnerable organisations. No need to do anything now.
- ztgasdf 6y agoI went to the IP and it sent a single file (1B) containing a line break. I don't know if they changed it recently, but that's what happens on that URL right now.
- jlgaddis 6y agoUsing which HTTP client? To test "correctly", you'd likely want to use the requests library or, at the least, ussend the same User-Agent header that it does. (And, for all we know, they could just be targeting certain IP addresses... or only responding the "malicious" response the first time the URL is requested per IP... or some other weird conditions that we aren't aware of.)
- sodality2 6y agoIt returns a null binary. Of course, this could be a targeted attack though.
- dthul 6y agoThe setup.py that I saw doesn't do anything with the response of the HTTP request so if it were indeed a targeted attack it would need to exploit some kind of weakness in the network stack. I guess that makes a targeted attack quite unlikely.
- oli5679 6y agoHi thanks for sharing. The above I noticed and I thought it was captured quite well by the title. Thank you for flagging though it is useful context. My overall assessment is that this is grey/whitehat but merits further investigation.
- LinuxBender 6y agoIf we are being honest, nobody here can really answer that. The requests can act benign until the attacker chooses to change the payload based on source IP, time of day, source network, user-agent, etc... I believe it is best to block any outbound network connection you did not define in your code. e.g. your code uses a filtering proxy for approved API destinations.