Malicious software libraries found in PyPI posing as well known libraries

Re:Malicious software libraries found in PyPI posing as well... by zokier on Friday September 15, 2017 @12:31PM (#15258435)

> One partial mitigation is to use a firewall (e.g., Amazon VPC network ACLs) to restrict outbound network traffic to a small number of known addresses like well-known repos.

That breaks down very quickly with the combination of public CDNs and TLS. I suppose you could do SNI based firewalling, but that is bit ugly, and afaik you can't do that easily with common firewalls (like netfilter).

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by hodgesrm on Friday September 15, 2017 @03:14PM (#15259920)

As I mentioned above some of this goes back to application design. Ideally if you are layered correctly the application components of the system that own data should not talk to the outside world except in very narrowly circumscribed ways.

Unfortunately most real world systems that have internet access are created in far from ideal conditions.

[ Parent | on HN ]

Re:Malicious software libraries found in PyPI posing as well... by katastic on Friday September 15, 2017 @02:35PM (#15259523)

This. If it was that easy we'd already be doing it on all our desktops and servers.

[ Parent | on HN ]