17 ms·
Aggressive Attack on PyPI Attempting to Deliver Rust Executable
- belinder 4y agoHow is the rust part relevant?
- baguettefurnace 4y agojust like if a tesla is involved in a car crash, headline must mention Tesla
- butterNaN 4y agoIsn't that because sometimes the tesla software might be at fault?
- baguettefurnace 4y agoThe software is rarely at fault if you follow up on the stories. If every time a human driver crashed a car it was the lead story in whatever news you consume, you'd likely never drive.
- throwthere 4y agoChatgpt recommended it for the upvotes.
- wheelerof4te 4y ago"The most beloved programming language used to build and ship malware (PHOTO/VIDEO/NSFW)"
- HL33tibCe7 4y agoIt’s unusual for malware.
- selfmodruntime 4y agoYes, but only for the time being. I‘ve recently published a paper on the topic. Rust and Golang are getting immensely popular with malware authors.
- hoppla 4y agoI would love a link so I could read your paper.
- arthurcolle 4y agoSame! Please share GP
- Godel_unicode 4y agoI mean, not really? There’s a lot of legacy stuff written in other languages, but malware authors have realized that people are less skeptical of rust and are actively taking advantage of that fact.
- yabones 4y agoWe like when malware is written in a memory-safe language.
- dtgriscom 4y agoEncrypt my files, but please don't waste my RAM while you do so.
- lost_tourist 4y ago"it's amazing what they were able to do with that old pentium linux server that someone forgot in the server room, so much damage! rust is truly the future"
- mftb 4y agoIf a payload is native it's potentially more of a problem than a script. If the payload had been c or c++, I wouldn't have been surprised if they noted that either.
- sidlls 4y agoWe should only refer to Rust when it's included in positive events? How is it not relevant here? It was used to build executables to inject, likely for malicious purposes. Given its newness and all the other hype around it, I'd say it's very relevant.
- puffoflogic 4y agoWhy not also be sure to mention what OS was used for the build, and what linker, and what file format, and what model of computer was used, and what its default ui language was set to? What is so special about programming language used that sets it apart from those other factors that could be mentioned?
- muraiki 4y agoThe use of Rust has particular implications for malware analysis: https://c3rb3ru5d3d53c.github.io/2022/08/malware-reversing-rust/ https://c3rb3ru5d3d53c.github.io/2022/08/malware-reversing-r... So yes, it's relevant.
- puffoflogic 4y agoThat article is nonsense and the author could not even complete it. It is buried in a shallow grave of irrelevance.
- muraiki 4y agoHere's an article from the SEI covering the problems with using Ghidra for malware analysis of Rust code. See "Binary Analysis Without Source Code" https://insights.sei.cmu.edu/blog/rust-vulnerability-analysis-and-maturity-challenges/ https://insights.sei.cmu.edu/blog/rust-vulnerability-analysi...
- puffoflogic 4y agoYou cite yet another article which you clearly don't understand, and whose authors have questionable understanding themselves. This article cites CVEs of a certain type, which were especially popular in the 2021 timeframe. These CVEs do not correspond to real vulnerabilities in real executables. Rather, they are reporting instances of rust programs violating the strictest possible interpretation of the rules of the rust language. For comparison, quite literally every single C program ever written would have to receive a CVE if C were judged by the same rules, because it isn't possible to write a C program which conforms to the standard as strictly as these Rust CVEs were requiring. CVEs of this nature are a bit of a meme in the rust community now, and no one takes them seriously as vulnerabilities. They are reporting ordinary, non-vulnerability bugs and should have been reported to issue trackers. The whole discussion about layout order is completely irrelevant. When RE'ing unknown code you don't know the corresponding source anyways, so the one-to-many correspondence of source to layout is irrelevant. You are given the layout. You can always write a repr(C) which corresponds to it if you're trying to produce reversed source. This is no different than not knowing the original names of variables and having to supply your own. The next objection is literally that rust does not use null-terminates strings, except the authors are so far out of their depth that they don't even identify this obvious root cause of their tools failing. Again, this has absolutely nothing to do with the reversibility of rust programs, except perhaps preventing some apparent script kiddies from figuring it out. The authors do manage to struggle to shore, as it were, by the end of the article, and somehow they end up correctly identifying their tools and understanding and the root cause of their troubles, not Rust. I take it you didn't make it that far when you read it?
- hoppla 4y agoBecause everywhere it’s used, it has to be explicitly mentioned, like clothing that use GoreTex™.
- lelandbatey 4y agoInterestingly, all the packages, even the ones from today, have all been taken down. So too have all the files that were being hosted on Dropbox.
- ashishbijlani 4y agoWe’ve built Packj [1] to detect packages with install hooks, embedded binary blobs, and other such malicious/risky packages. It performs static/dynamic/metadata analysis to look for "suspicious” attributes. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj
- lrem 4y agoWhy are these things riskier than the plain Python code you likely don't read, but go ahead and execute?
- deleted 4y ago[deleted]
- twodave 4y agoIt's relative, but I assume it's flagging for certain class of known malicious patterns. There's nothing stopping you from writing malicious python code, but essentially that script will only run while you expect it to in most cases unless it interacts with the OS in some way. It doesn't make plain Python code you blindly execute any safer, but at least you've explicitly given those packages your trust. I believe this is more geared toward detecting compromises of those packages you have given that trust.
- colatkinson 4y agoPackages can do weird things like auto-loading into the interpreter (example: [0]). So in a scenario where a malicious package has ended up on your machine, you're a bit screwed whether it's a .so or a .py. I believe that was the point OP was making -- a pure-Python wheel is not really any safer than a wheel with embedded binaries. [0]: https://github.com/pyston/pyston/blob/1d65d4831912179c26bb27187cc60eefd565fdcf/pyston/pyston_lite/autoload/setup.py#L12 https://github.com/pyston/pyston/blob/1d65d4831912179c26bb27...
- Godel_unicode 4y ago
- woodruffw 4y agoI understand that this is meant to be an eye-popping press release (and implicitly a product spotlight), but some of these claims make me gag. It's not an attack "on" PyPI, or even an attack at all: someone is just spamming the index with packages. There's no evidence that these packages are being downloaded by anyone at all, or that the person in question has made any serious effort to conceal their attentions (it's all stuffed in the setup script without any obfuscation, as the post says). The executable in question isn't even served through PyPI (for reasons that are unclear to me): it's downloaded by the dropper script. Ironically, serving the binary directly would probably raise fewer red flags. Supply chain security is important; we should reserve phrases like "aggressive attack" for things that aren't script kiddie spam.
- asperous 4y agoI think it's a serious threat, especially with LLMs now because people can make believable packages at scale. Not everyone vets their packages thoroughly
- woodruffw 4y agoYou've always been able to make "believable" packages at scale. PyPI doesn't enforce uniqueness: you can crank out malicious near-duplicates of any package you please.
- zeven7 4y agoAnd, to parent's point, now LLMs will tell people to use them and they will[1]. [1] https://news.ycombinator.com/item?id=34916682 https://news.ycombinator.com/item?id=34916682
- Groxx 4y agoStack Overflow and Google search results were already doing that though, at massive scale. I agree it changes things somehow, but people not thinking before acting is not a new problem.
- blibble 4y agowhy does pypi/pip still not have namespacing? Maven sorted this out 20 years ago what's a bit sad is the python packaging's authority survey from a few months ago seemed to be mostly interested in vision and mission statements rather that building a functional set of tools
- djbusby 4y agoEvery lang-ecosystem needs to re-implement CPAN the hard way.
- woodruffw 4y agoNamespacing is not a security boundary: it's a usability feature that helps users visually distinguish between packages that share the same name but different owners. I don't think it would meaningfully affect things like package index spam, which this is. (This is not a reason not to add namespacing; just an observation that it's mostly irrelevant to contexts like this.)
- blibble 4y agoobviously, but it allows delegation of trust onto other systems (like the DNS) example: the package named "aws" on pypi was created by some random guy and has been abandoned for years if pypi/pip supported namespacing that would be info.randomdude.aws instead and amazon's packages would be under com.amazon not being able to namespace internal packages is another security issue that is substantially improved with proper namespacing to be blunt: not supporting it at this point is reckless and irresponsible (I note you're part of pypa!)
- ianai 4y agoEven animals in the wild agree to peace around the watering hole.
- eternalban 4y agoYou forgot some of those animals have fangs. It's like NYC's side walks. Compare pedestrian behavior at say SoHo (daylight) and say LES (nighttime). Amazingly enough, the partying and inebrieted pedestrians at night all file politely in the correct bimodal L|R formation. During the day, it's a rather wild and somewhat uncivilized dynamic slalom formation. My theory: Fangs. The night creatures know someone potentially dangerous maybe in the midst.
- readthenotes1 4y agoSomeone forgot to tell the crocodiles... https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0055182 https://journals.plos.org/plosone/article?id=10.1371/journal...
- MadSudaca 4y agoThe problem is assuming we’re better than animals.
- ianai 4y agoI was rolling the shame or guilt card.
- timeon 4y agoBy animals you mean something like mammals?
- almet 4y agoIt's still the same story : PyPI still doesn't have a way to automatically detect interactions with the network and the filesystems for the submitted packages. It's a complex thing to do for sure, but that would be a welcome addition, I guess.
- woodruffw 4y agoPyPI still doesn't have this because no packaging ecosystem does. It's impossible to do in the general case if your packaging schema allows arbitrary code execution, which Python (and Ruby, and NPM, and Cargo, etc.) allow. The closest thing is pattern/AST matching on the package's source, but trivial obfuscation defeats that. There's also no requirement that a package on PyPI is even uploaded with source (binary wheel-only packages are perfectly acceptable).
- eigenvalue 4y agoThis seems eminently solvable though. Why can’t every package submission cause some minimal sandboxed docker image to install the package and call the various functions and methods and log all network and disk activity? If anything looks suspicious it would be denied and the submitter would have to appeal it, explaining why the submission is valid. The same applies for NPM and Cargo. I know there is a researcher out there who has retrieved and installed every single pip package to do an analysis, which is a good start. This seems like the kind of thing that wouldn’t even cost all that much, and big corporate users of python would stand to benefit.
- nodogoto 4y agoWell some calls absolutely should invoke network or disk activity, so you would additionally need to define what constitutes good and bad activity for each. Moreover unless the package is a collection of pure functions it would be easy to hide the malware trigger in state that won't be initialized properly by the automated method calls but would be in the standard usage of the package.
- woodruffw 4y ago
- i_love_cookies 4y ago[dead]
- photochemsyn 4y agoWow this site runs a lot of JavaScript, speaking of aggressive data collection. https://blog.hubspot.com/website/data-mining https://blog.hubspot.com/website/data-mining
- throwaway81523 4y agoWonder if that is related to the malware spamming of NPM that I saw something about last night. Python used to have a "batteries included" philosophy which tried to put most important stuff into the distro, reducing the number of external dependencies any given app needed. They seem to have abandoned that now, leaving us to fend for ourselves against the malware. NPM spam: https://www.scmagazine.com/analysis/devops/npm-repository-15000-phishing-packages https://www.scmagazine.com/analysis/devops/npm-repository-15...
- wheelerof4te 4y ago"They seem to have abandoned that now, leaving us to fend for ourselves against the malware." Yes, along with reducing the stdlib and directing us to PyPI for "alternatives".
- throwaway81523 4y agoDumpster diving anyone? Npm always felt that way and PyPI is catching up.
- fortran77 4y agoBut I thought Rust was supposed to be safe?!
- steponlego 4y agoYet another attack that requires the biggest malware vector, MS Windows. LOL
- puffoflogic 4y agoI read TFA three times and I still have no idea what they meant by "Rust stage 1 executables". In these cases I frankly assume that they don't either.