News for hackers. Stuff that matters.

A comment on Malicious software libraries found in PyPI posing as well known libraries. Parent comment

Re:Malicious software libraries found in PyPI posing as well... by edraferi on Friday September 15, 2017 @09:38AM (#15257012)
I appreciate the proactive approach.

Is your project the author of the packages identified by NBU? If so:

(1) Why is the tracking pingback obfuscated?

(2) Why does the code include a cheeky hello instead of a link to https://www.pytosquatting.org/ ?

(3) Why is there not a visible warning when installing one of these packages?

=================

edit:

Reading through the linked blog post [0], it appears these researchers used different code that DID provide visible warning and an cleartext pingback. It also collected command history and hardware information.

[0] http://incolumitas.com/2016/06/08/typosquatting-package-mana...

[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by hannob on Friday September 15, 2017 @10:00AM (#15257196)
We're not the authors of those packages. But we own many others.

1. We're not obfuscating pingbacks.

2./3. We're raising an exception with an explanation and a link.

Just look at the code of one of our packages: https://pypi.python.org/pypi/codecs

The research in 2016 was done by someone else. The kinda crazy thing is: Some of the package names he used were made available again after that instead of being blocked... And now we own them.

[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by edraferi on Friday September 15, 2017 @10:10AM (#15257250)
Man. You're right - that's a mess.
[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by chupapuma on Friday September 15, 2017 @11:38AM (#15258014)
And just to be super clear, this is the code. Hard from scary or obfuscated:

  html = urllib_request.urlopen(
  "https://www.pytosquatting.org/pingback/pypi/{}/".format(package_name)
  )
  raise Exception(
    "This is a bogus package that should not be installed\n\n"
    "Please read https://www.pytosquatting.org"
  )
[ Parent | on HN ]
Re:Malicious software libraries found in PyPI posing as well... by sounds on Saturday September 16, 2017 @12:41AM (#15262918)
"Hard from scary or obfuscated" Maybe you are typing on mobile?

"Far from scary or obfuscated" reads more clearly.

[ Parent | on HN ]