10 ms·
Python malware starting to employ anti-debug techniques
- khiqxj 4y ago[dead]
- gumboza 4y agoThe more I hear this stuff the more I write things in Go with no external dependencies pulled in. I can do 95% of what I need to do without involving a supply chain or downloading anything random off the internet other than the go distribution itself.
- shanebellone 4y agoAnti-dependency mafia, rise up. I feel the same way. I code almost everything from scratch too.
- intelVISA 4y agoIt's reassuring isn't it? Every time something breaks you have easy access to the mfer who wrote it.
- shanebellone 4y agoExactly! We're also talking about layers of dependencies. It's a ridiculous approach.
- deleted 4y ago[deleted]
- mschuster91 4y agoI get the general idea, but at the same time, I don't have the time to write my own libraries from scratch - all modern web standards are complex and most libraries filled with years to decades worth of experience of all the edge cases that crop up, particularly as most standards don't carry a "compliance test suite". It's one thing if I were paid by my employer to re-invent the wheel, but for personal projects... I don't have that much free time for them in the first place any more, I want to get shit done and not shave yaks all day. When I want a good grind, I'll pack out Factorio or one of the LEGO Switch games...
- bigDinosaur 4y agoA compromise is to audit and then pin exact versions, or even copy and paste the code into your project. Yes, this is a clear tradeoff in that you'll lose access to newer updates, but it's certainly worth thinking about. I do it with relatively trivial libraries for things that I know the package has solved various edge cases, is small in scope, and probably won't be updated again, for example.
- shanebellone 4y agoI agree with you, but I'd prefer to reinvent the wheel rather than audit an existing code base.
- shanebellone 4y agoThere's a difference in values between those who reinvent the wheel and those who leverage opensource. It sounds like you value time-to-product whereas I value ownership of said product. There are always risks associated with building on other people's land, platforms, and codebases. However, there are also risks when reinventing the wheel. Both perspectives have advantages, disadvantages, and use cases.
- isoprophlex 4y agoI like the sentiment and I'm usually first in line to ridicule the 'npm install left-pad' crowd, but this doesn't always fly. Python is a great glue language to mash high performance C/fortran components together. One does not simply write sklearn or pytorch from scratch.
- shanebellone 4y ago"Python is a great glue language to mash high performance C" This is exactly what I'm starting to work through. After 6 years of Python, I've finally hit the limit of what I can do with it. Now I'm working to rebuild an algorithm in C to reconnect to the Python application. "One does not simply write sklearn or pytorch from scratch." I also agree with this. Would either be in a product though? Personally, if it's not a product, I wouldn't mind dependencies.
- anakaine 4y agoYes, they are in at least one product I can think of, and likely more. That product deploys its own conda environment and includes a huge amount of spatial analytical tools. Governments and large private enterprise the world over use ArcGIS Pro, as do many NGOs and education institutions, which is a massive leap forward for both desktop and highly integrated Web GIS work. I'd be prepared to be a bit of blind money that other industry tools use a similar setup where the python libraries permit an exceptional cadence of development and help place those vendors products at the pointy end of the market. How they manage dependency security isn't super clear. They're always a couple of version behind, so perhaps it's a CI/CD QA/QC thing which also includes security.
- pjmlp 4y agoI always build my whole computer from scratch from NAND gates all the way up to the full OS, build my own switches, cut the network cables myself, dependencies be dammed. /s
- cuteboy19 4y agoFor python at least, most of the dependencies are very justifiable. The python stdlib is very huge and satisfies most regular programs such as glue code. But for web and ML it is not possible to include these libraries in stdlib nor is it feasible to write it from scratch
- shanebellone 4y agoIt's not difficult to write most of it from scratch. It just takes some time and attention.
- cuteboy19 4y agoIt's not possible. Even very basic numpy would be too slow to use, if you end up writing pure python equivalents. If you import numpy might as well import the entire scipy ecosystem
- shanebellone 4y agoIt's absolutely possible. My only dependency is Flask and I'll be eliminating that in time too. Why do you need numpy for web? Edit: I will concede that there is no point in retooling ML. Web is an entirely different circumstance though.
- deredede 4y agoFlask seems to be a very stable and feature-complete framework (I see about 3 commits per year for the last few years). At this point isn't it easier and just as safe to manually review the code, pin the hash in a lockfile, and manually review the rare changes than it is to rewrite everything?
- shanebellone 4y agoDefinitely. There's nothing wrong with using Flask. It's actually quite pragmatic. In my case, replacing Flask is purely preference.
- PurpleRamen 4y agoI don't think the Go-stdlib is significant better than the Python-batteries. For normal stuff, you can build without dependencies in python too. The problem starts when you use more complex stuff, or want to save time by using a lib delivering certain benefits. After all, you can't build and maintain everything by yourself.
- gumboza 4y agoShipping Go is a hell of a lot easier.
- throwaway_3850 4y agoStandards and requirements will change, bits will rot, and im not expecting any ecosystem, to keep up with comming and going demands. A better solution imho would be project level capabilities, so you can pull in a dependency but restrict its lib/syscall access, so it would not compile when it turns malicious. Maybe it will solve at least something, maybe some day.
- gumboza 4y agoAgree. I'd like to see an OpenBSD pledge(2) type system for libraries. So you can mask individual library capabilities rather than just programs. I don't want a web server that can write to the file system and I don't want a CSV reader that can talk to the network.
- saagarjha 4y agoDoing this kind of thing at the library level is generally not very useful, because security protections between things running in the same process are hard to make very strong.
- LadyCailin 4y agoThis is a limitation of the particular language/ecosystem though, it feasible in a new language that has this security baked in to the language primitives.
- nonrandomstring 4y agoSimple but probably wrong solution; why not ban obfuscation libraries, compressed and self-loading code within the PyPI ecosystem. Any package that even refers to illegible non-source techniques gets flagged and blocked? It seems the whole PyPI ecosystem is undisciplined and could be tightened up. Why can't we progress here?
- anothernewdude 4y agoYeah, just get rid of anything that has a binary blob. Cool. And then when PyPI gets swapped out for whatever immediately replaces it because PyPI is useless, then at least PyPI will be secure.
- nonrandomstring 4y ago> PyPI is useless Why will it be "useless". Explain your reasoning please.
- pletnes 4y agoMost of the libraries I use include compiled C/C++/Fortran/Rust code. Pandas, scipy, scikit-learn, … if I were limited to pure-python libraries, I would probably rather swap languages, or at least package manager, at great inconvenience. That being said, I don’t think PyPI would be «useless» - this was the state a few years ago, and we had to compile all the libraries ourselves. I don’t want to go back.
- nonrandomstring 4y ago> great inconvenience It's a convenience/security trade-off, I see. The only solution I've ever seen to that requires investing trust in an "authority" which then becomes corrupt and censorial. One simply expands the dilemma to a triad; security/freedom/convenience. If I am not mistaken the PyPI "Cheese Shop" is owned by the Python Software Foundation, a 501(c3) nonprofit organisation which constitutionally values Software Freedom highly. It seems natural that convenience would be sacrificed if security is of concern.
- toxik 4y agoIt was in fact not anti Python debugging but just run of the mill checks for IDA Pro and the likes.
- tasty_freeze 4y agoThose things you named are just one of the checks it made. The python part of it was also an encode bzip file that offers a bit of debugging headache, then it downloads a pyc file which was run through an obfuscator, which more of a python headache. Your "in fact" is not a fact.
- fear-anger-hate 4y agoThe methods this malware uses for anti debugging wouldn't cause headache for anyone that isn't completely new to the subject. Download 10 random python malware samples and you'll notice that probably at least 8 of them follow this exact same packing and execution pattern. Discord hook and laughable end payload are a good indication that whoever wrote this is probably some high school kid. The only surprising thing about this article is the claim that these type of malware haven't been spotted in pypi before. That would suggest that there isn't much of credible actors trying to spread through pypi at all.
- yourapostasy 4y agoHuh. It never ceases to amaze me when another demonstration is presented to me that “plus ça change, plus c'est la même chose“ in this industry. I suppose it is only to be expected that some of the old anti-piracy techniques found in 8-bit floppy- and cassette-distributed software might eventually find new philosophically-similar implementations in malware in the future. Some of that self-modifying and anti-defeat code back then were truly works of art, and squeezed into mind-bogglingly small memory and cpu foot prints, and the malware authors will have a field day re-implementing their future cousins in spirit, and some of the greybeards amongst the white hats will get to relive their 8-bit glory days hunting and defeating them. The article gave a description of a really super primitive technique compared to the last generation of those anti-piracy techniques, but I still see a family resemblance.
- khiqxj 4y ago[dead]
- bb88 4y agopython eval() is the root of all evil. Basically if the library uses eval() it's probably a good idea to avoid it if possible.
- baeaz 4y agoThat makes me think - would it be possible to have a runtime or build time option for cpython that removes eval() ?
- bb88 4y agoProbably. But python missed their chance to nix it with the 2->3 transition. My favorite case was when a newbie coder used eval() to evaluate something that looked json-ish, which, came from an api request.
- dtgriscom 4y agoSimple and powerful. Gotta love it (until your customer doesn't, big-time).
- theptip 4y agoIf you run a security linter like ‘bandit’ you’ll get warnings for eval and other security holes. It seems you can’t run bandit on deps, but perhaps if you fork them and build yourself? If you are security conscious, having a rule that you can only install from a local pypi with packages you have forked would be a more defensible perimeter. But, a maintenance pain for sure.
- dylan604 4y agobut python is not the only language to have an eval(), so why is python's in particular the root of all evil?
- tiagod 4y agoIt's not literal.
- hybridtupel 4y ago> Malware that is more stealth-conscious would just stop running without any indication, instead of interacting with external processes. I always wondered if we could just use this against the malware. E.g. just run a useless process which is named/looks like a debugger and the malware stops itself. Of course that's nothing to be relied on on its own but maybe as an additional layer of defense?
- revolvingocelot 4y agoMakes me think of that "weird domain name"-based ransomware mitigation. https://www.theverge.com/2017/5/13/15635050/wannacry-ransomware-kill-switch-protect-nhs-attack https://www.theverge.com/2017/5/13/15635050/wannacry-ransomw...
- dylan604 4y agoor adding a russian language pack to your system. some of these are so silly sounding that they are almost unbelievable on first hearing of them.
- fear-anger-hate 4y agoSome EDRs do stuff like adding russian keyboard layout as an alternative, which stops a fair share of 'malware as service' type stealers.
- Run_DOS_Run 4y agoIs this really worth an article? The anti-debugging protection just stops executables using a list of hardcoded filenames (eg. Wireshark.exe). This is neither interesting nor new and was already implemented 20 years ago by script kiddies. What's next? A VBS Trojan that takes commands via Matrix instead of IRC?
- passwordoops 4y agoApologies for the naive or off-topic question. I'm still a relatively new hobby Pythoner, and no formal training in CS. I clearly get the security risks associated with random libs available for Python. Is this also the case for other languages like Java? Are the dependencies available to them also a relative free-for-all, or are bugs mostly accidental? Thanks!
- _frkl 4y agoI think there is always a danger, for every language, when you install a 3rd party dependency from a package repoitory. But usually this is restricted to the runtime of the application that uses the 3rd party library (and maybe, depending on the language, the code-paths that are executed). That's a difficult enough problem to deal with already, but with Python, it's possible to execute code at install time of such a 3rd party library (basically, when you do a 'pip install stuff'). So, you might never have run the application you installed, but you'd still have executed whatever malware was hiding. This is not the case for a lot of other languages. Also, Python allows the execution of code when you have an `import stuff` statement, which is also not the case in other languages, often. But this is not directly related to this, just another 'Python-specific' attack vector.
- josephcsible 4y agoOne of the underappreciated benefits of Richard Stallman getting what he wants would be that antivirus programs could then be updated to flag on all obfuscated code or anti-debugging actions.
- khiqxj 4y ago[dead]
- dotancohen 4y agoTo what are you referring with "Stallman getting what he wants"? Code being open source?
- josephcsible 4y agoIf all software were free as in speech.
- theptip 4y agoI’m wonder if there is room for a security model based around “escrow builds”. Imagine if PyPi could take pure source code, and run a standardized wheel build for you. That pipeline would include running security linters on the source. Then you can install the escrow version of the artifact instead of the one produced by the project maintainers. You can even have a capability model - most installers should not need to run onbuild/oninstall hooks. So by default don’t grant that. This sidesteps a bunch of supply-chain attacks. The cost is that there is some labor required to maintain these escrow pipelines. With modern build tools I think this might not be unworkable, particularly given that small libraries would be incentivized to adopt standardized structures if it means they get the “green padlock” equivalent. Libraries that genuinely have special needs like numpy could always go outside this system, and have a “be careful where you install this package from” warning. But most libraries simply have no need for the machinery being exploited here.
- SQueeeeeL 4y ago>Libraries that genuinely have special needs like numpy could always go outside this system, and have a “be careful where you install this package from” warning. But most libraries simply have no need for the machinery being exploited here. My personal experience with any situation where I need to get some crusty random python library to run has always been a situation with a lot of "-y"ing, swearing, and sketchy conda repositories. Usually it's code that was written years ago and does some very particular algorithm that's essential, so any warnings in the pipeline basically becomes ignored by the sheer difficultly of the task.
- westurner 4y agoSigned, Reproducible builds from source off a trusted build farm are possible with conda-forge, emscripten-forge, Fedora COPR, and OpenSUSE OBS Open Build System https://github.com/pyodide/pyodide/issues/795#issuecomment-1250113736 https://github.com/pyodide/pyodide/issues/795#issuecomment-1... What does it mean for a package to have been signed with the key granted to the CI build server? Does a Release Manager (or primary maintainer) again sign what the build farm produced once? What sort of consensus on PR approval and build output justifies use of the build artifact signing key granted to a CI build server? How open are the build farm and signed package repo and pubkey server configurations? https://github.com/dev-sec https://github.com/dev-sec https://pulpproject.org/content-plugins/ https://pulpproject.org/content-plugins/