Re:PyPI: Python packets steal AWS keys from users
by Pv9KKy3 on Sunday June 26, 2022 @07:43PM
(#31889162)
Yeah, I'd love to have a decorator at the top of a file - @env to provide access to env variables or @secrets for some kind of secrets access, nothing else gets this.
Python is tough though, a very dynamic language so probably kind of hard to lock it down.
Re:PyPI: Python packets steal AWS keys from users
by Beltiras on Monday June 27, 2022 @06:33AM
(#31892657)
You would normally be able to solve things like this via file permissions in the OS but currently we are running everything as root inside a container.
Re:PyPI: Python packets steal AWS keys from users
by Pv9KKy3 on Monday June 27, 2022 @07:40AM
(#31893153)
Not really, because the dependencies to your python code often have access to all global variables and/or run at same permission level as all your code etc.
Re:PyPI: Python packets steal AWS keys from users
by grepfru_it on Sunday June 26, 2022 @10:20PM
(#31889951)
Is it really automated? The infographic glosses over the how with a “security research team” in the flowchart. Maybe the automation catches suspicious code/activity (like the urls or accessing sensitive files) and the research team just verifies
Wonder if something like pledge and unveil around library code could be helpful; perhaps library code needs to be separated out into a separate process that would not have reason to access AWS keys.
Also, looking at the screenshot, could a simple programming searching for URLs in the library code help in this case?
Looks like they removed the modules, so one can't examine them any more.