Re:Python Malware Starting to Employ Anti-Debug Techniques
by zzzeek on Friday December 23, 2022 @06:52AM
(#34104811)
None of those packages are downloading and running CRAP.EXE within the setup.py process, that's not how native extensions work. It should be possible to flag packages that are downloading things when setup.py runs, much less running exec within setup.py. a python package that really needs you to run a windows installer for its dependencies should have you be doing that separately.
[ Parent
| on HN ]
Re:Python Malware Starting to Employ Anti-Debug Techniques
by pletnes on Friday December 23, 2022 @09:06AM
(#34105914)
Sure, I didn’t intend to claim that. It’s just a hassle for me to compile my own C code, which I’d have to do if binaries weren’t bundled. That’s why anaconda python took off on windows - it’s hard work to compile scipy on windows!
Re:Python Malware Starting to Employ Anti-Debug Techniques
by zzzeek on Friday December 23, 2022 @09:19AM
(#34106038)
pypi delivers wheel files for pre-built binaries, and that's the only way one is supposed to distribute pre-built binary executables or shared libraries. the issue of "runs malicious code in setup.py" does not apply in that case because setup.py isn't invoked.
Re:Python Malware Starting to Employ Anti-Debug Techniques
by BiteCode_dev on Friday December 23, 2022 @11:39AM
(#34107724)
Yes but the problem here is the obfuscation of the malware code loading. No need to trigger it in the setup.py process, as long as you have it in the lib, you can always put a call in a .pth somewhere and run your malware as soon as any python is executed.
Re:Python Malware Starting to Employ Anti-Debug Techniques
by zzzeek on Friday December 23, 2022 @03:12PM
(#34110108)
it should be possible to test packages for that also. if you are testing setup.py to see that no network access or exec occurs, you could similarly run the python interpreter after install and ensure no network / exec() happens at that point either, assuming one has not imported the package. or just disallow .pth files from being installed altogether.
Re:Python Malware Starting to Employ Anti-Debug Techniques
by BiteCode_dev on Saturday December 24, 2022 @11:09AM
(#34118105)
Given that every attempt to sandbox python failed, and that every system exposed to the public have been pwn, I assume this is a cat and mouse game we can't win.
At best I suppose we could put in place checks to get low hanging fruits. But we are, after all, allowing a turing complete and highly dynamic language to execute.
> or just disallow unfamiliar .pth files from being installed altogether
That would kill the entire plugin ecosystem.
Now, the next thing could be to have a permission system, requesting access to the network, fs, .pth, etc. It would not be a bad idea, given that we are, after all, installing things that are as powerful as apps.
But it would be a gigantic effort, and users still would just accept without reading, like they do with apps.